magicpath

SUSPICIOUS. The skill’s main capabilities generally fit its purpose and the CLI appears to be a legitimate same-vendor npm package, so this is not confirmed malware. However, the embedded load-time pre-execution of `npx -y magicpath-ai info` is a major trust and execution-boundary problem because it can download and run external package code before normal review/approval, and the skill also enables transitive local installation of MagicPath-hosted skills.