skill-installer

SUSPICIOUS: the skill's purpose as a meta-installer is coherent, and no clear credential theft or malicious exfiltration is described, but it materially increases trust surface by installing multiple downstream skills/tools and writing into user/project skill paths. The main risk is transitive installation and delegated package/tool execution, not confirmed malware.

This module is primarily an installer/updater for an “azure-devops-cli” skill. It does not show clear indicators of stealthy malware (no eval/backdoor/exfiltration), but it introduces significant supply-chain and execution risk: it runs a remote script as root via `curl -sL ... | sudo bash` to install Azure CLI (non-darwin/non-win32), and it installs skill content from an external GitHub source via `npx -y skills add ...` (unverified third-party code). Overall, treat as a higher-risk dependency due to external code execution/installation paths rather than because it contains explicit malicious logic in this snippet.

No direct malicious payload or stealth behavior is evident within this module itself; however, it is a high-risk supply-chain bootstrapper. It clones a remote repository at install/update time without visible integrity pinning, runs `npm install` and `npm run build` on the fetched code, persists the resulting artifacts, and registers `dist/index.js` as an MCP server entrypoint that will be executed by the host. If the upstream repo or any transitive dependency is compromised, this flow could lead to arbitrary code execution in the installed server context. Treat as a significant security review item and require pinning/integrity verification and hardened installation controls.

This file does not show direct malicious payload behavior (no exfiltration, no reverse shells, no `eval`-style execution). However, it performs a high-impact software supply-chain operation: it clones an external GitHub repository at update/install time without pinning or verifying integrity, copies all upstream skill directories into a runtime-enabled skills directory, and registers them for use by the host framework. Additionally, the uninstall path relies on a manifest for filesystem deletions, which could be dangerous if manifest integrity/path confinement is not assured elsewhere. Overall, the dominant risk is unverified upstream supply-chain delivery and resulting runtime compromise in the broader system.