aigo-builder

SUSPICIOUS. The skill’s platform-development capabilities and tenant API flows broadly fit its purpose, and the install source is same-org and documented. However, its unprompted destructive self-updater and credential use with a proprietary, non-registry CLI create significant supply-chain and credential-forwarding risk. No evidence in the supplied material confirms credential theft or unrelated data exfiltration.

This is changelog documentation, not executable code, and the visible text does not indicate malware or credential exfiltration. Its main security concern is the described automatic updater: remote main or main.zip content can trigger hard resets and broad overwrite/deletion of registered skill installations without user confirmation, making compromise of the trusted update source consequential. The fragment also describes ticket and screenshot uploads to a reporting service, but no credential types are stated as targets and no suspicious destination domain is supplied. Overall risk is elevated for data loss and update-source compromise, not evidence of malicious intent; implementation details are not visible.

這是防禦性平台開發指南，而非惡意程式碼。文件揭露一項高影響的權限缺口：不應將 `dc_` 開頭的平台目錄表登記為 app 引用，尤其 `dc_ext_field_defs` 可能允許一般 app 使用者繞過 schema 權限並刪除資料。應確認並移除相關引用，並由平台修正 proxy 的授權檢查。

This is a deployment utility, not evident malware: it packages configured project files and deploys them using an environment-provided AIGO_DEPLOY_TOKEN. The principal security concern is that the API-provided deployd_upload_url is only required to use HTTPS; an unexpected host could receive the source archive and dispatch upload token. The tenant URL is restricted to the expected ai-go.app subdomain pattern, and no hardcoded secrets or obfuscated behavior are present; severity is moderate and the upload-host validation should be reviewed.

The fragment is an automatic updater rather than apparent malware. Its network destinations are fixed GitHub repository URLs, subprocess use is limited to fixed git operations, and there is no evident credential theft, persistence, reverse shell, cryptomining, or data exfiltration. The principal security concern is supply-chain trust and destructive update behavior: mutable remote content is downloaded and applied without integrity verification, and local files may be overwritten or deleted. ZIP path validation should explicitly reject traversal and absolute paths before writing. Malware likelihood is low based on this file alone, but compromise of the referenced repository could affect users.

The code is intended to scaffold a React project and materialize virtual-filesystem entries. Its file-writing helper accepts unvalidated paths, enabling a caller able to control `vfs_state` to write outside `project_path` and bypass exact-name protected-file checks; this is a moderate filesystem security risk. No malware behavior such as network exfiltration or process execution is shown, and the fragment is syntactically invalid as provided.

The configuration is an automatic startup/resume updater hook. It contains no direct malicious payload, but it delegates privileged behavior to an unavailable Python script and explicitly describes forced remote synchronization that may overwrite local installations. Review and pin the referenced script and remote source before enabling; the actual malware and security assessment of the updater requires that script and its dependency behavior.

The supplied configuration is a startup/resume auto-update hook. It does not itself demonstrate malware, but it delegates privileged-looking filesystem and network behavior to an unreviewed Python script and explicitly permits destructive forced synchronization from a remote main branch. Review scripts/check_update.py, its remote repository configuration, Git commands, download validation, and handling of local changes before enabling it.