fleet-worker

SUSPICIOUS: the skill’s purpose and capabilities are mostly aligned, but it grants spawned headless workers broad autonomous edit/bash powers with bypassPermissions and sends task/repo data plus API credentials to a third-party endpoint by default. This looks like an intentionally powerful orchestration skill rather than malware, but its autonomy and third-party data flow make it high-risk to use without strong local trust and careful scoping.

The fragment appears to be a documented launcher rather than malware. It deliberately forwards an API key to the configured model endpoint and defaults to Claude's `bypassPermissions` mode, which can expose the host to consequential actions initiated through the agent. Use a trusted endpoint, verify the Claude executable, and choose a restrictive permission mode and allowlist where appropriate. The unescaped effort value can corrupt or alter newly generated settings.