install-script-generator

SUSPICIOUS. The skill is internally consistent—its risky behavior matches its stated purpose—but that purpose is to generate remote download-and-execute installers. There is no clear credential theft or covert exfiltration, so this is not malware, but it has high supply-chain risk because it encourages unpinned raw-URL execution in bash and PowerShell.

The fragment contains no clear malware indicators, data theft, persistence, or exfiltration. However, using shell=True with the unvalidated --target value creates a significant command-injection vulnerability, and the configurable output path permits arbitrary writable-file overwrite. Use argument lists with shell=False, validate the target against an allowlist or executable-name pattern, and constrain output paths.

The code is a legitimate-looking installation-plan runner, not apparent malware. Its primary security concern is deliberate arbitrary shell execution from plan-controlled command, verification, and rollback fields. It is safe only when the plan file is fully trusted and protected from tampering; an attacker able to modify the plan can execute commands with the privileges of this process. The code itself contains no evidence of data theft or hidden malicious behavior.