kmp-token-saver

The script is a readable installer for a third-party Claude Code plugin and shows no direct malicious behavior in the provided fragment. Its main risk is persistent installation of unpinned external code at user scope without signature, checksum, or commit verification. Review and trust the Ponytail marketplace/plugin before execution, and require explicit user confirmation for the global installation.