wespy-fetcher

SUSPICIOUS: the skill’s purpose is coherent, but its install/exec trust is weaker than necessary because it auto-clones mutable code from a personal GitHub repo and executes it from a hardcoded local path instead of using the documented package channel. No clear credential theft or overtly malicious behavior is shown, but the third-party content proxy and source-install inconsistencies raise medium supply-chain and data-flow concerns.

No direct data theft, destructive behavior, or other malware is evident in this fragment. It does automatically download and execute unverified code from a remote repository, which creates a meaningful supply-chain risk. Review and pin or verify the upstream code before running.