clearshot

SUSPICIOUS: the core screenshot-analysis purpose is plausible, but the skill adds non-essential update and telemetry behavior, including remote version checks, mutable self-update via git pull, hidden local logging, and optional POSTs to a Convex endpoint. These behaviors are not fully proportionate to the stated purpose and create medium security risk, though there is not enough evidence to call it confirmed malware.

This is an installer that fetches and executes code from a fixed GitHub repository. No direct malicious behavior is evident in the fragment, but the unverified remote setup execution is a material supply-chain risk, and shell quoting of the install path is unsafe for paths containing shell expansion characters. The contents of the remote setup script require separate review.