experience-content-media-stock-image-search

This is not obviously malicious malware; it is a utility that retrieves a sensitive Salesforce access token from the local `sf` CLI and uses it to download remote content. The primary security issue is a trust-boundary flaw: the script sends the Bearer access token to a caller-provided HTTPS URL without domain allowlisting or stronger validation, enabling credential leakage if `--url` can be controlled by an attacker. A secondary risk is writing unvalidated remote bytes to disk (and optionally opening certain formats in VS Code), which can be problematic depending on downstream handling. Overall risk is moderate due to credential exposure potential rather than explicit malicious behavior.

SUSPICIOUS: The skill’s core purpose and official-tool ecosystem are mostly coherent, but it escalates from search to credentialed local download by reading a raw Salesforce access token and supports automatic billed downloads in non-interactive mode. Data flow appears Salesforce-aligned rather than overtly exfiltrative, so this is not confirmed malware, but it carries medium security risk and disproportionate credential handling for a stock-image helper.