ubs

SUSPICIOUS. The skill's stated capability is coherent with a code scanner, and there is no evidence here of credential harvesting or off-purpose data exfiltration. The main issue is install trust: it asks the agent/user to execute a mutable raw GitHub script from a personal account via `curl|bash`, with additional local side effects, instead of the documented verified release flow.