web-shader-extractor

SUSPICIOUS: the core extraction behavior matches the stated purpose, and install sources are largely legitimate first-party channels, so this is not fundamentally incompatible with its claimed role. However, the skill is overconfident about safety and disproportionately instructs the agent to auto-install software and operate without user confirmation, creating medium risk from autonomous system modification and supply-chain hygiene rather than clear malicious intent.