superpowers-codearts-installer

SUSPICIOUS: the skill’s stated purpose matches its installer behavior, and the upstream repo is legitimate, so this is not clearly malicious. However, it installs a large third-party skill set from a mutable GitHub source into the agent’s active skill directories, creating medium supply-chain and transitive-trust risk.