engineer-skill-creator

SUSPICIOUS. The documented behavior is largely coherent and local, with no clear credential theft or exfiltration, but provenance ambiguity and transitive remote skill installation create moderate supply-chain risk. Based on the supplied text alone, this is not confirmed malicious.

The script appears intended for local engineer-profile skill generation and contains no evident malware, exfiltration, persistence, or destructive behavior. However, it has a high-impact command-injection vulnerability because interactive input is evaluated with eval. Unsanitized username and custom skill name also enable path traversal and unintended filesystem reads/writes. Remove eval, use direct variable assignment, and strictly validate usernames and output names before use.