bioresearcher-python-setup-uv

SUSPICIOUS. The skill’s purpose is coherent, but its actual footprint includes a high-risk alternate install path: a third-party Gitee mirror/wrapper executed via curl|sh or Invoke-Expression. The official Astral path is legitimate but still mutable and poor install hygiene; the mirror path is disproportionate because it replaces a first-party installer with unverifiable third-party install code and future package-management trust. No clear credential theft or exfiltration is present, so this is not confirmed malware, but it is a high-risk setup skill.