wix-headless-replatform

The fragment appears to be a legitimate dependency and Playwright environment remediation utility, not malware. Its main security weakness is unsafe shell execution: dynamically constructed installation commands are passed to a shell without escaping or argument arrays. Inputs should be validated and commands should use spawn with shell:false and separated arguments. Automatic installation also inherently trusts package-manager lifecycle scripts. No direct data theft, persistence, destructive behavior, or suspicious exfiltration is present.

This is a build/documentation utility for materializing captured visual assets. It does not show evidence of intentional malware. The primary security issue is an unsafe trust boundary: untrusted inline SVG or symbol markup is written into a potentially web-served public directory without sanitization, which can create stored XSS or active-content risks. The destructive recursive deletion is expected for regeneration but should be constrained by validated output-path handling.

SUSPICIOUS: the skill’s purpose and capabilities are mostly aligned with frontend QA automation, and there is no explicit credential harvesting or third-party proxying. However, the named local executables and overall runtime trust path are not publicly verifiable from the supplied evidence, and the skill grants broad autonomous build/fix/review authority, so it carries medium security risk despite lacking strong malware indicators.