parable

SUSPICIOUS: the core orchestration behavior matches the stated purpose, but the skill materially expands trust by building/running a patched proxy that handles provider authentication and by installing an additional skill package via npx. This looks more like a high-trust developer tool than outright malware, yet the proxy-mediated credential flow and transitive skill installation make the overall risk medium.

No clear indicators of intentional malware/sabotage (no obfuscated payloads, no exfiltration to unexpected domains, no backdoor behavior). The primary security concern in this fragment is command injection risk in cmd_verify/run_check: subprocess.run(cmd, shell=True) executes a command string originating from config with partial replacement using user-provided --targets. Additionally, the tool executes external binaries from PATH and writes many files to a project-local log directory as expected for an orchestrator.

This fragment is a hook configuration that triggers OS-level execution of local Python scripts based on host-derived runtime events. The configuration itself contains no explicit malware indicators (no secrets, domains, or obfuscation), but it materially increases supply-chain and runtime risk because it delegates sensitive behavior to external scripts located under a potentially environment-dependent plugin root. Security confidence is limited because the referenced Python script contents are not provided; audit those scripts and ensure ${CLAUDE_PLUGIN_ROOT} cannot be tampered with in deployment.