jta

SUSPICIOUS. The skill's purpose and capabilities are coherent for i18n translation, and it routes credentials to the expected provider through the declared translation tool. The main concern is install trust: it requires a separate CLI, offers a direct download-and-execute path from mutable GitHub release URLs, and forwards API keys to that tool without documented verification of binaries. This looks more like a legitimate but higher-risk developer workflow skill than malware.

This installer is straightforward and contains no direct signs of embedded malware in the script itself. The main security concern is supply-chain integrity: it downloads an executable from a `releases/latest` GitHub Releases endpoint and installs it into `/usr/local/bin` via `sudo` without any checksum/signature validation. A compromised release artifact, upstream account, or delivery channel would likely result in execution of untrusted code on the target system. Recommend pinning to a specific version and adding hash/GPG signature verification before executing/installing; additionally consider safer install practices (e.g., verifying expected file metadata and using a temporary location with atomic move).