artifacts-builder

SUSPICIOUS. The stated purpose is coherent for a frontend artifact-builder skill, and the visible instructions do not show credential theft or exfiltration. However, the skill's real behavior depends on unseen shell scripts that install and execute third-party tooling, including some ambiguous/non-official package components, so install trust cannot be fully verified from the provided content.

This appears to be a legitimate scaffolding/setup script with no direct indicators of intentional malware (no exfiltration, backdoor logic, or obfuscated execution). However, its supply-chain integrity is meaningfully weakened by (1) blind extraction of a local tarball into `src/` without checksum/signature verification (allowing arbitrary code injection into the app), and (2) broad dependency installation from public registries with limited version pinning (increasing exposure to compromised or unexpected upstream packages/install-script execution). The main concern is supply-chain tampering rather than overt malicious behavior in the script.