agent-starter-kit

SUSPICIOUS: the skill’s stated purpose matches its behavior, but its core function is to install many other skills/plugins, including a meta-skill that can install more skills later. The `npx skills` path looks legitimate, so this is not confirmed malware, but the transitive trust chain and broad capability expansion make it a medium-risk starter bundle rather than a low-risk single-purpose skill.

The script is a benign-appearing bootstrap/installer that primarily acts as a supply-chain facilitator: it automatically fetches and installs multiple third-party agent “skills” via `npx` and multiple Claude Code plugins/MCPs via the `claude` CLI, with no version pinning or integrity/signature checks and with suppressed installer output. There is no direct evidence of malware logic in this file itself, but the automated remote installation behavior creates a significant supply-chain risk that warrants pinning, verification, and review of upstream artifacts.