set-up-machine

SUSPICIOUS: the skill's purpose broadly matches its machine-setup capabilities, and there is no clear credential theft or covert exfiltration. However, it has a large trusted footprint, installs and updates third-party skills/plugins/tools from mutable sources, includes a raw GitHub bootstrap execution path, and introduces transitive trust by loading other skills, so the overall security risk is high even without confirmed malware.

This script overwrites ~/.claude/CLAUDE.md and modifies ~/.claude/settings.json to instruct an agent to run a setup script from a specified repository and allow that Bash command. The command-path validation permits shell metacharacters, so a crafted argument can change the command when the agent executes it. The script does not itself clone repositories or execute commands, but its generated instructions and permission rule create a significant risk of unauthorized command execution through the later agent. Severity: high if arguments are untrusted; no specific domain, IP, or credential target is present.