skill-install-manager

SUSPICIOUS. The skill’s behavior matches its stated purpose, but that purpose is itself high-risk: it automates global installation of many other skills from mutable GitHub sources, including a self-update from a community repo, and can bypass the CLI by manually fetching files and editing the lockfile. No obvious credential theft or off-platform exfiltration is present, but the transitive trust and supply-chain footprint are disproportionate enough to warrant caution.

The fragment appears to be a legitimate skill installation/update tool, not obvious malware. It has a meaningful command-injection risk because several command-line values are embedded into strings passed to runCommand, subject to how runCommand executes commands. It also trusts remote repository contents and lacks visible validation for skill names, repository paths, and lock-file paths. The code should use an argument-array process API, validate names and URLs, constrain downloaded paths beneath the intended directory, and restrict or validate the lock-file location.