xyq-skill

This is a legitimate-looking CLI bootstrapper, not direct malware based on the supplied file. It performs network installation and executes package-provided installer code and binaries with the user's privileges. Use of @pippit-dev/cli@latest without version pinning or explicit integrity verification creates a meaningful supply-chain risk, and PATH-based executable reuse can run an unintended binary if PATH is compromised. No credential theft, exfiltration, obfuscation, persistence beyond the intended cache, or destructive behavior is evident in this fragment.