content-writer

This module is primarily a local installer: it removes a prior skill directory, creates a structured set of skill folders under ~/.claude/skills, copies bundled markdown and reference files into those folders, and records a version marker. There are no direct indicators of data theft, network exfiltration, or in-JS obfuscation in the provided fragment. The main supply-chain risk is the optional execution of a bundled shell script via execSync; if that script (or package) were tampered with, it could run arbitrary commands on the user system. Review/verify scripts/install-dependencies.sh and overall package integrity before use.

The provided Bash installer is a high-risk supply-chain bootstrapper. It clones external GitHub repositories at runtime without pinning or integrity verification, and for claude-seo it directly executes a script (install.sh) from the freshly cloned, unverified repository. While no explicit malware behavior is visible in this snippet (no exfiltration/backdoor logic present), the mechanism is a straightforward path to arbitrary code execution if upstream code is malicious or compromised. Recommend pinning to specific commits, adding checksum/signature verification, and avoiding direct execution of unaudited remote install scripts (or running them in a restricted/sandboxed manner).

This package runs a postinstall script that will execute arbitrary JavaScript during installation. Combined with the unusual self-referential dependency (same name as the package) this is a notable supply-chain risk. You should not install without reviewing scripts/postinstall.js (and any code it loads or invokes) and verifying the dependency resolution. Treat as high risk until the postinstall script contents and the reason for the self-dependency are validated.