aidlc

This module is an installer/migrator that downloads and extracts a remote ZIP bundle from GitHub and then copies/merges its contents into a chosen local project directory. It does not show direct in-module malware behaviors (no exec/subprocess, no credential theft, no exfiltration). The main security concerns are (1) unverified remote download, (2) unsafe ZIP extraction via extractall without member path validation, and (3) high-impact configuration/hook injection driven by the downloaded archive contents, which could enable malicious behavior in downstream tooling if the archive is compromised. Migration can also delete legacy artifacts, increasing potential impact.