material-design-3-ui

This module is an installer/downloader that fetches a manifest and related files from a remote GitHub ref and installs them into user-scoped agent skill directories. The code includes basic path traversal protections for manifest-driven writes and a simple SKILL.md name check, but it lacks cryptographic authenticity/provenance verification of the downloaded content. The main security concern is supply-chain tampering (compromised upstream repo/ref or manipulated manifest leading to malicious skill files installed). Additionally, -Link mode likely creates symlinks to a temp directory that is deleted at the end, creating a reliability/availability problem rather than direct malware.