apple-container-coding-agent

This module functions as a harness for untrusted agent execution and evidence capture. It contains no clear standalone malware behavior (no networking, no persistence, no hidden payloads), but it does execute arbitrary command arguments from /run/agent-command.json using subprocess.run, which is the primary high-impact security concern. Snapshot extraction includes meaningful path traversal/special-device/FIFO protections, but symlink/hardlink-related tar edge cases are not explicitly blocked, so extraction safety is only partial. Evidence generation via git diff --binary will capture all workspace changes, potentially including sensitive data written by the executed agent.