skill-publish-verify

SUSPICIOUS: the skill's behavior matches its stated purpose, but that purpose is inherently high-risk because it installs and exercises arbitrary third-party skills and lets untrusted SKILL.md content drive agent actions. No direct malware indicators or credential-harvesting endpoint are shown, but the transitive install and prompt-injection surface make this a high-risk verifier skill.

This code is an automation wrapper that runs `pip install` based on dependency specifications read from skill_dir files (requirements.txt or SKILL.md). It contains no obvious in-module malicious payload (no exfiltration/backdoor mechanisms), but it creates a meaningful supply-chain risk because it installs arbitrary third-party packages determined by unvalidated external content, and it records full pip output to disk.

This module itself contains no overt malicious payloads (no hardcoded secrets, no network calls, no persistence). However, it conditionally executes an on-disk script provided by ctx (skill_dir/scripts/run.py) using an interpreter path provided by ctx (isolate_env['python']). If upstream workflow inputs or the skill package are not fully trusted/sandboxed, this creates a significant supply-chain preflight execution risk; it also captures and returns stdout from the executed code.