insta

SUSPICIOUS: the skill's purpose aligns with infrastructure management, and most credential/data flows are proportionate to that role, but the footprint carries notable trust risk. The main concerns are the raw GitHub pipe-to-shell installer, transitive installation of additional agent/MCP components, broad shell permissions, and the ability to take real infrastructure actions. No clear credential exfiltration or overtly malicious behavior is shown, so this is not confirmed malware.

No definitive malicious logic is shown in this documentation fragment, but it describes a high-risk supply-chain execution model: multiple unverified `curl -fsSL <remote> | sh` installer invocations, plus floating-version execution via npx and repo-modifying auto-installed skills/hooks. It also writes credentials to local `.env`. This should be treated as a significant integrity/reproducibility security review item—verify/pin the installer content and inspect any auto-installed repo components before use (especially in CI).