threejs-earth-render

SUSPICIOUS: the skill’s purpose is coherent, but its footprint includes fetching and executing unverified third-party repo code plus Puppeteer-downloaded binaries and CDN runtime dependencies. No credential harvesting or overt exfiltration is evident, so this is a supply-chain-heavy medium risk rather than confirmed malware.

This Python module itself shows no clear direct malicious logic (no hardcoded secrets, no eval/exec in Python, no explicit exfiltration or destructive actions). However, it substantially increases supply-chain and execution risk by (1) cloning/updating an arbitrary user-configurable git repository, (2) installing npm dependencies (puppeteer, unpinned/transitive), and (3) executing a Node/Puppeteer capture script that will load and run code served from the cloned repository in a headless browser. Any real malware would most likely reside in the cloned repo content, the capture_threejs_earth.mjs logic, or the npm dependency chain rather than in this wrapper. Treat as medium-to-high supply-chain risk and require pinning/verifying repo commits and dependency versions, plus reviewing the Node capture script.