remote-package-installer

SUSPICIOUS: the skill is internally consistent, but its whole purpose is to fetch and install an unverifiable remote Python wheel from a non-real domain with no integrity checks. This is a high supply-chain risk even without evidence of credential theft or other malicious behavior.

The command itself does not demonstrate malware, but it attempts to install an unverified remote wheel from an invalid-looking domain. The actual wheel contents are unavailable, so malicious behavior cannot be ruled out. Treat this installation as unsafe and require a trusted source, integrity hash or signature, and package inspection before use.