engineering-advanced-skills

SUSPICIOUS. The skill’s capabilities fit its Docker-focused purpose and there is no clear credential theft or exfiltration, but the install trust is weaker than ideal: unpinned personal-repo Git clone, an unverified local install/conversion script, and a transitive skill-install path. This is better classified as supply-chain and trust risk than malware.

SUSPICIOUS: the skill's stated Helm-chart purpose matches its capabilities, and there is no evidence of credential theft or exfiltration. The main issue is install trust: a personal GitHub clone, execution of repo-provided scripts, and inconsistent OpenClaw install instructions create medium supply-chain risk disproportionate to a simple documentation/local-analysis skill.

SUSPICIOUS: the stated purpose is a skill bundle index, but it also directs transitive installation through a third-party CLI and a personal GitHub repo, creating meaningful supply-chain and inherited-permission risk. No direct credential theft, exfiltration, or pre-execution malware behavior is shown in this snippet.

This code fragment functions as an abuse-enabling “stealth/evasion toolkit” for Playwright automation: it injects scripts to remove automation indicators, spoofs multiple high-signal browser fingerprint surfaces (navigator properties, WebGL vendor/renderer, canvas pixel output), and simulates human-like interaction timing, with optional proxy routing. While there is no clear evidence of credential theft, persistence, or exfiltration in the provided snippet, its explicit anti-detection design materially increases the likelihood of bypassing access controls and performing potentially unauthorized scraping. Treat as high misuse risk rather than confirmed self-contained malware.

No clear evidence of stealthy malware (exfiltration/persistence) is visible in the fragment. However, the code contains a significant and concrete security risk: it executes a user-provided evaluation command with `subprocess.run(..., shell=True)` directly from the CLI argument --eval, enabling arbitrary command execution. Optional evaluator copying and branch creation further expand supply-chain/code-introduction risk, but their safety cannot be confirmed from this snippet.

This module itself is not visibly malicious or obfuscated, but it contains a high-impact security design flaw: it executes a user/config-provided eval_cmd via subprocess.run(..., shell=True) with cwd set to a git worktree path. If an attacker can influence --eval-cmd or the per-session config.yaml content, this becomes a straightforward arbitrary command execution vector. Additionally, config.yaml is read from a path constructed using an unvalidated session_id, which can pose an unintended file read/path traversal risk depending on caller constraints.

No direct evidence of embedded malware (e.g., exfiltration, backdoors, persistence) or intentional obfuscation is present in this module’s logic. However, it has a critical supply-chain/sandbox-break risk: it executes a shell-interpreted command (shell=True) taken directly from experiment_dir/config.cfg (evaluate_cmd). If config.cfg (or experiment_dir contents) can be influenced by an attacker, this becomes arbitrary command execution in the project directory. The script also performs destructive git resets on failure/timeout, increasing operational impact. Recommend strict validation/whitelisting of evaluate_cmd, avoiding shell=True (use argv lists), and running evaluations in a heavily restricted environment (e.g., container/sandbox) with immutable configs.