agent-dispatch

This is a repository coding-agent benchmark runner, not evident standalone malware; it contains no hardcoded domains, URLs, IPs, or explicit credential collection. It launches an agent with permission checks bypassed and executes task-provided acceptance commands through a shell, so untrusted task definitions or agent behavior can cause arbitrary actions under the runner's OS account and expose inherited environment credentials. Unsanitized task IDs and hidden-test paths also create path-manipulation risk. Severity is moderate to high when task data or the agent is untrusted; use only with trusted inputs and a suitably isolated environment.