avalanche-demo-init

No direct malicious or obfuscated behavior is evident in this module. However, it performs high-impact supply-chain operations (git clone + uv sync + PATH-resolved npx/pnpx/bunx skills install) and then imports/executes a generated Python workflow during verification. The security posture therefore depends heavily on the integrity of upstream repositories, installed dependencies/skills, and the host’s toolchain binaries available on PATH.