claude-code-source-recovery

SUSPICIOUS: the skill's research/documentation purpose is mostly coherent, and the code examples themselves are not malicious, but the install path is not proportionate to a documentation skill. It relies on unofficial distribution sources—a Tencent mirror package tarball and a personal GitHub recovery repo—rather than Anthropic's verified channels, with no checksum or signature verification. That makes the main risk supply-chain trust, not confirmed malware or credential theft.