auto-skill

SUSPICIOUS: the core memory/knowledge-base behavior is plausible, but the skill’s actual footprint is not proportionate because it tries to make itself mandatory across all tasks and persist by editing global IDE instructions. The only external install is optional and medium-risk, but the stronger concern is unauthorized persistence and broad behavioral control.

No clear evidence of classic malware (no network exfiltration, credential theft, command execution) is present in the provided fragment. However, the protocol explicitly performs durable persistence by modifying a global configuration file (~/.claude/CLAUDE.md) to force a “task启动协议” on every future session, and it maintains growing local knowledge/experience stores. This persistent self-bootstrap behavior is the main supply-chain security concern (behavioral lock-in/privacy/data-retention risk) even though malicious payload indicators are not shown. Overall: treat as a potentially unsafe persistence/memory agent unless implementation details confirm strict safety boundaries.