agent-starter-kit

The script is a benign-appearing bootstrap/installer that primarily acts as a supply-chain facilitator: it automatically fetches and installs multiple third-party agent “skills” via `npx` and multiple Claude Code plugins/MCPs via the `claude` CLI, with no version pinning or integrity/signature checks and with suppressed installer output. There is no direct evidence of malware logic in this file itself, but the automated remote installation behavior creates a significant supply-chain risk that warrants pinning, verification, and review of upstream artifacts.

SUSPICIOUS: the skill’s purpose aligns with its behavior, but it is a transitive installer whose actual script is missing and whose bundle expands agent capabilities significantly. Risk comes from broad downstream trust and unverified install details, not clear evidence of malware or credential theft in the provided text.