model-selector

SUSPICIOUS: mostly coherent with a model-selection/routing skill, but trust extends to unprovided local Python scripts and any dependencies uv may execute, and the skill reads Claude session logs to infer permission state. No clear malicious exfiltration, proxying, or credential-harvesting endpoint is shown, so this is not confirmed malware; the main concerns are local-script trust, repo dependency execution, and broad local state access.