skill-installer

SUSPICIOUS. The skill’s purpose is coherent and its data flows stay on GitHub, so it is not overtly malicious. Risk comes from transitive trust: it installs other skills, including from arbitrary GitHub repos and mutable refs, with no checksum/signature verification, enabling unreviewed remote content to gain agent influence.

This module appears to be a functional GitHub-based installer that fetches and installs arbitrary repository content chosen by user input. It does not show overt malware behavior (no exfiltration, credential theft, or hidden execution) within the provided code. The security risk is mainly supply-chain and operational: it executes git based on user-controlled ref/paths, downloads and extracts third-party ZIP archives, and then copies untrusted directories into the local filesystem after only minimal validation (SKILL.md presence). ZIP extraction includes a basic boundary check against path traversal, but additional archive safety (symlink/hardlink/resource exhaustion) and stronger integrity verification (commit pinning/signatures/hashes) are not evident in this module.