pact-coverage

SUSPICIOUS: the core coverage-analysis behavior is coherent and the broker data flow matches purpose, but the skill expands trust significantly through a third-party ripwire dependency, raw installer instructions, automatic agent-wide skill activation, and transitive skill usage. This is not confirmed malware, but it is higher-risk than a typical read-only analysis skill.

The supplied fragment is installation documentation, not the ripwire implementation. It contains no direct evidence of malware, but the curl-to-bash installer, mutable main-branch dependency, unsigned binary download, broad agent skill activation, and MCP/hook registration create meaningful supply-chain and execution risks. Review install.sh, release-download logic, binary provenance, skills, and hooks before use; prefer pinned versions, checksums or signatures, and manual inspection.