zopack

SUSPICIOUS: the skill’s core behavior matches its stated purpose, but importing a pack can install arbitrary npm packages, fetch third-party component definitions from URLs, write files, and deploy route code. Those capabilities are proportionate to a route-packaging tool, yet the trust model is weak: untrusted pack content can drive high-impact actions, and review is advisory rather than enforced. This is not confirmed malware, but it is a medium-high risk skill due to supply-chain exposure and deployment of untrusted code.