install-memu

This fragment implements Windows Scheduled Task installation/removal for periodic, hidden PowerShell execution with '-ExecutionPolicy Bypass'. It generates a wrapper that executes an agent CLI with arguments derived from spec.schedule_command and redirects all output to a log file. Although there is no explicit exfiltration/destructive action in this code, the persistence/stealth execution pattern is strongly associated with malware and should be treated as a high supply-chain risk. Confidence is reduced because the executed agent behavior is outside this module and the snippet ends mid-function.

The skill is broadly coherent with its stated purpose: it installs an official memU package, chooses a host adapter, and integrates long-term memory by adding a scheduler and instruction hook. The main risk is not overt malware but the combination of package installation, optional API-key forwarding, persistent background tasks, and automatic instruction-file modification performed with minimal confirmation. Overall this looks more like a legitimate but high-impact integration skill than a deceptive credential harvester.

No direct malicious payload is shown in this fragment (it is a design/ADR description rather than implementation code), and the design includes fail-open robustness plus structural validation to prevent malformed templates from breaking execution. However, it enables remote update of shell-capable agent instruction content and performs no cryptographic authenticity/integrity verification of fetched templates, which is a significant supply-chain integrity risk: a compromised or malicious template that still conforms structurally can be cached/installed and subsequently used by the agent. Secondary concerns include non-monotonic cache/version behavior and the remote base URL override as an implementation-dependent risk surface.

No concrete malicious payload is visible in this fragment because it is an installation guide rather than executable package code. However, it materially increases supply-chain risk by defaulting to an unpinned `main` git install of memU-cli and by recommending direct execution of remote bootstrap scripts for installing uv (curl|sh / PowerShell|iex). The real malware/persistence risk would reside in the upstream memU-cli code, especially the host-specific `memu-<host> docs install` step that can register tasks and modify local files; that implementation is not shown here. Mitigate by pinning to a specific commit SHA, validating upstream integrity, and limiting privilege during setup.