gkeep

SUSPICIOUS: the skill’s capabilities fit its stated Google Keep purpose, but it depends on an unofficial API and instructs users to enter a Google app password into a third-party CLI. The biggest risks are credential forwarding and unspecified binary installation provenance in the skill itself, not clear evidence of overt malware or unrelated data exfiltration.

This postinstall script instructs npm to create a Python virtual environment and install packages from requirements.txt. While this may be legitimate for a package that wraps Python functionality, it introduces a moderate-to-high supply-chain and execution risk because it causes automatic downloading and installation of Python packages (which can execute arbitrary code at install time). The specific risk depends on the contents of requirements.txt; if it points to untrusted sources, git/http URLs, or malicious packages, the installer could trigger data exfiltration, telemetry, or arbitrary code execution. Review requirements.txt and any installed package sources before running this install script.