backend

No executable backend logic is present in this fragment; it is documentation plus a high-risk installer instruction. The principal security issue is the `curl -fsSL <remote> | bash -s backend` pattern, which executes an unverified remote script and therefore materially increases supply-chain risk. Since the actual `install.sh` and slash-command/generated code are not included, there is no direct evidence of malware in this snippet, but the installation mechanism warrants thorough review (pinning/verifying integrity and auditing the fetched script).

SUSPICIOUS: the skill’s behavior mostly matches its stated backend-scaffolding purpose and shows no credential harvesting or off-platform data routing, but the install trust is weaker than ideal. The main concern is supply-chain risk from transitive skill installation and a raw GitHub `curl|bash` installer on an unpinned branch with no release verification.