skill-downloader

SUSPICIOUS. The stated purpose matches the behavior, but the footprint is still high risk because the skill is a transitive installer for other skills from arbitrary external sources, including third-party repos and marketplaces, without strong provenance controls. This is not confirmed malware, but it materially expands agent trust to unreviewed downstream skill content.

No explicit malicious logic (e.g., execution, exfiltration, persistence) is present in this snippet. However, the code is a high-risk supply-chain installer: it extracts untrusted ZIP/TAR archives using extractall without validating member paths (Zip Slip/Tar Slip class risk) and then installs the extracted contents wholesale into a user-controlled output directory. Additionally, SKILL.md frontmatter validation/parsing appears buggy, weakening any intended checks. Treat this as security-sensitive and require hardening (safe extraction with member-path validation, symlink/link controls, and archive integrity verification).