printing-press

SUSPICIOUS: the skill's broad capability set mostly matches its stated purpose of generating API CLIs, but it has a materially large trust footprint: same-org raw installers, external CLI delegation with `--yolo`, authenticated browser-sniffing, live API testing, and transitive sub-skill execution. The documented secret-handling controls reduce concern, so this is not confirmed malicious, but it is high-complexity and medium-high risk for an agent skill.

The visible fragment is an API-discovery and browser-sniffing procedure. It contains intentional collection of network traffic, request/response bodies, cookies, and authenticated session data, followed by storage and replay. Credential scrubbing is specified, but the capture capability remains high risk if implemented incorrectly or used without strict authorization. No clear malware, exfiltration destination, persistence, or sabotage behavior is shown. Treat as security-sensitive tooling requiring authorized targets, strong isolation, verified redaction, and review of the unseen remainder.

The fragment is not application code and does not show a direct malware payload. It is suspicious orchestration content that delegates repository modification and command execution to Codex with `--yolo`, reads repository data into prompts, performs broad git stash operations, and uses a writable marker file as the completion authority. These behaviors present a significant supply-chain and developer-environment security risk, although direct malicious intent is not established from the shown text alone.

The script is primarily a document downloader and cache utility with no clear embedded malware. Its main security risks are operational: arbitrary user-controlled URLs can trigger outbound requests and access internal resources, redirects are unrestricted, and the --md fallback dynamically downloads and executes unpinned npm packages through npx. The npx behavior should be replaced with pinned, preinstalled dependencies or explicitly controlled package versions and registry settings. Local cache tampering is also possible if the temporary directory is shared or attacker-writable.