skill-downloader

SUSPICIOUS: The skill’s behavior matches its stated purpose, but that purpose is itself a high-risk transitive installer for third-party AI agent skills from arbitrary URLs, archives, and community repos. No direct credential theft is shown, but provenance is weak, validation is unverified, and the installed skills inherit agent trust and permissions.

The code is a legitimate archive downloader and installer, but it has significant filesystem safety weaknesses. Archive path traversal, unsanitized destination names, unrestricted remote downloads, and destructive --force behavior could allow a malicious archive or command-line input to write or delete files outside the intended skill directory. It should not be used with untrusted archives until extraction containment checks and destination-name validation are added. No direct malware or covert data theft is evident in this fragment.

No clear malicious behavior is present in the supplied fragment. It implements skill downloading and local copying, but it has a potentially serious path traversal/absolute-path issue because an unvalidated SKILL.md name controls deletion and copy destinations. The risk is especially high when --force is used with untrusted local directories. The imported downloader modules must be reviewed separately for network and archive security.