kdocs

SUSPICIOUS: the skill’s document-management capabilities match its stated purpose, but its trust model is weak. A required, not-fully-verified `kdocs-cli` handles user tokens and document content, and the skill includes remote update paths via setup scripts/CDN and instruction-supplied ZIP replacement. This is high supply-chain and credential-forwarding risk, not confirmed malware.

No explicit malware/backdoor code is present in this installer module. The primary security concern is supply-chain integrity: it downloads an executable and installs it, while checksum verification is not fail-closed (verification is skipped when the expected archive hash is absent from checksums.txt or when other verification errors occur). Additionally, the download source is controlled by an environment-variable-configurable CDN_BASE, which could be manipulated. Treat this as a potentially dangerous installer component and harden by enforcing checksum presence/verification (fail closed), pinning/allowlisting trusted download hosts, and reducing reliance on shell-based extraction without path/content validation.

This module does not show classic in-script malware indicators (no obfuscation, no credential theft, no exfiltration logic, no reverse shell). However, it performs a high-impact supply-chain action: it downloads and installs an executable from a CDN (with the CDN base overrideable via environment variables). Integrity protection is only best-effort—if checksums cannot be obtained or the expected entry is absent, the script proceeds to extract and install anyway. Combined with user PATH modification and installation of the first matching executable from the ZIP, this creates a meaningful supply-chain trust risk in hostile or tampered-CDN scenarios. Recommend enforcing strict checksum presence/verification failure as hard stop, pinning CDN host/scheme, and validating ZIP contents (exact expected file paths) before installation.