clui-cc-claude-overlay

SUSPICIOUS. The core overlay behavior broadly matches the stated purpose, and most flagged commands are documentation examples, not active malicious logic. However, install trust is weak: the recommended path executes an install script from a personal GitHub repo unrelated to Anthropic, while the skill also auto-installs other skills from GitHub and exposes a custom skill execution surface. The 'entirely local' claim is overstated because marketplace operations fetch remote content. This is not confirmed malware, but it has meaningful supply-chain and transitive trust risk.