new-project

SUSPICIOUS. The skill's capabilities largely match its stated purpose as a large project scaffolder, and there is no clear credential theft or exfiltration behavior. However, its footprint is unusually broad and it relies heavily on mutable third-party installers and @latest scaffolding flows, including direct repo cloning, which creates meaningful supply-chain risk beyond a narrowly scoped skill.

The fragment appears to be a legitimate project scaffolding generator rather than malware. It performs extensive expected filesystem generation and does not show exfiltration, persistence, command execution, or obfuscated payloads. However, the generated payment code has significant security weaknesses: unsigned webhook fallback, client-controlled Stripe checkout parameters, a mock and insecure Razorpay order endpoint, and inconsistent escaping of interpolated scaffold inputs. These issues warrant remediation before generated applications are used in production.