gemini-use-claude-acp

No explicit malware indicators (e.g., credential theft, reverse shells, direct exfiltration, or eval-based payload execution) are present in this wrapper code itself. However, it substantially elevates supply-chain and authorization risk by running `pnpm dlx @zed-industries/claude-code-acp` at runtime (network-fetched execution) and by setting `CLAUDE_CODE_SKIP_PERMISSIONS='1'` unconditionally for the spawned tool. The wrapper also modifies PATH to prefer a user-writable directory under some conditions. Treat this as a high-risk execution/supply-chain delegate: it should be controlled with pinned versions/lockfiles, restricted network execution if possible, and reviewed for the spawned tool’s actual permission enforcement and behavior.

SUSPICIOUS: the skill's delegation purpose is real and mostly coherent, and its dependencies come from plausible official ecosystems, so this is not confirmed malware. But it expands trust to a second agent, uses unpinned `pnpm dlx` execution, depends on a deprecated adapter package, and disables Claude permission prompts with `CLAUDE_CODE_SKIP_PERMISSIONS=1`, creating elevated supply-chain and autonomous-action risk.