skill-install-manager

SUSPICIOUS. The skill’s capabilities are mostly aligned with its stated purpose, but that purpose is inherently high-trust: it installs and updates other skills from external repositories, supports SSH/manual fallback, writes directly into global agent skill locations, and can propagate unreviewed third-party instructions across agents. No clear credential theft or covert exfiltration is present, so this is not confirmed malware, but it is a high supply-chain and transitive-installation risk.

This code is primarily a high-impact installer for third-party “skills.” It can execute external npx-based installation/update commands and can also download arbitrary repository file contents and write them into a global skills directory, both without integrity/signature verification or explicit pinning. The most critical technical risk in this module is potential command injection via runCommand(cmd) because command strings are built from user-controlled CLI inputs; the exploitability depends on runCommand’s safety. Additionally, the manual GitHub fallback lacks explicit path sandboxing/normalization and the optional --lock parameter can enable file clobbering of any writable JSON path.

No direct malicious payload is present in the provided fragment (it is an install manifest). However, it defines a high-impact supply-chain process: it conditionally downloads and globally installs many third-party skills from external GitHub origins via `npx` without any visible version/commit pinning or integrity/signature verification. A compromise or malicious update in any referenced repository or the install pathway could lead to install-time execution and later malicious behavior.