hifi-download

SUSPICIOUS. The skill's core capabilities mostly match its stated music discovery/download purpose, and the flagged command patterns are documentation artifacts, not executable injection. The main risk is trust and credential handling around the unofficial tiddl CLI plus missing code for setup/run scripts, which prevents verification of exact dependency and network behavior. Not confirmed malware, but elevated security risk due to third-party credential/token handling and unverifiable implementation details.

The code is a straightforward virtual-environment script runner with no direct evidence of malware. Its primary security weakness is unchecked path traversal in the script-name argument, allowing execution of unintended Python files accessible through relative paths. Restrict the name to an allowlisted filename or validate it as a basename without path separators and traversal components.