loongsuite-pilot-ops

No direct malware payload or explicit exfiltration is visible in the provided PowerShell source. The main risk is high-impact execution of remotely downloaded and npm-installed code, with weak authenticity guarantees because checksums are fetched from the same source. The installer also stores sensitive credentials in plaintext configuration, creates scheduled persistence, installs broad third-party hooks/plugins, and enables a runtime wrapper capable of token interception. The script should not be treated as safe solely because this wrapper is readable; the downloaded ZIP, Node runtime, node_modules, postinstall scripts, and hook assets require independent verification and review.

This installer is high impact and contains security-sensitive telemetry behavior. It intentionally installs token and fetch interception hooks for qodercli, qoderclicn, Claude Code, QoderWork, and related tools, including persistent shell and macOS launchctl integration. That behavior can access authentication tokens and request data, so it requires strong trust in the package and hook assets. The fragment also has meaningful installer weaknesses: unsigned/unverified main package downloads, configurable remote dependency sources, unsafe JavaScript interpolation of user-controlled values, and unchecked archive extraction. No direct exfiltration destination or reverse shell is present in the shown Bash code, but the downloaded hook and application files are not available for review. The package should not be installed without independently verifying the remote artifacts and auditing the hook scripts.

The code appears to be a legitimate Windows service-management and upgrade script rather than malware. It does not show credential theft, data exfiltration, reverse-shell behavior, cryptomining, or destructive system-wide activity. The primary supply-chain risk is the upgrade command, which downloads and executes a remote PowerShell script with ExecutionPolicy Bypass without cryptographic verification. Use of this path should require trusted release infrastructure, signed or hash-pinned installers, and integrity validation. Other persistence and process-control behavior is consistent with the stated service-management purpose.

No direct evidence of malware or intentional data theft is present. The fragment is consistent with a privileged self-updater, but it is inherently high impact because remotely selected package contents and npm lifecycle scripts are executed. The most material security weaknesses are optional package checksum verification, lack of visible signature/authentication and manifest validation, and possible path-safety dependence on omitted helper implementations. Treat the configured manifest/package infrastructure and archive extraction routines as critical trust boundaries.

The code is an E2E test harness with high operational privileges and significant supply-chain exposure because it executes remote shell scripts, installs arbitrary npm package versions, injects credentials into probes, and can reboot or modify the host. These behaviors are consistent with its testing purpose, and the fragment contains no clear evidence of intentional malware or covert data theft. Use only with trusted installer URLs, trusted agent-matrix contents, isolated test hosts, and controlled credentials. The shown fragment also appears syntactically truncated near the end.

The fragment is readable configuration code for a telemetry and agent analytics product. It collects or enables collection of logs, traces, agent activity, and message content by default and supports sending that data to user- or configuration-selected endpoints. It handles numerous credentials and arbitrary update URLs. These are significant privacy and supply-chain review points, especially the default message-content capture and unverified auto-update configuration, but the shown code contains no direct malicious payload, credential theft logic, process execution, or explicit exfiltration destination. Review downstream exporter, file-collection, dashboard, and auto-update implementations before deployment.

This fragment implements deliberate, self-healing runtime interception and persistence across shell startup files, macOS LaunchAgents, Windows user environment variables, and Bun preload configuration. That behavior may be part of an intentional integration/watchdog, but it is inherently high impact because it redirects or preloads code into other developer tools and can execute configured repair binaries. No direct malware indicators such as exfiltration or credential theft are visible. The wrapper and omitted plist content should be independently reviewed, and dataDir, target.binPath, and installArgs must be trusted and safely quoted.

The supplied text is configuration and operational documentation for an agent telemetry collector. It documents intentional collection and local storage of potentially sensitive AI conversations and tool activity. No direct malware or executable malicious behavior is shown, but deployments should be reviewed for consent, data minimization, access control, retention, and the fact that some native source logs may retain content despite normalized content-capture settings.

Medium-to-high supply-chain risk. The code downloads remote artifacts (potentially over HTTP), extracts tarballs using system tar without visible archive hardening, and then can execute install shell scripts from within package/pilot directories. Hashing is present but not shown as enforced against a trusted value/signature. If attacker influence exists over URLs, tarballs, or extracted contents, this can lead to arbitrary code execution via the install script and/or filesystem traversal via tar extraction.

The code itself is a script-generation/orchestration utility, but it creates high-risk execution flows: it generates bash that downloads and executes remote install scripts (including `curl https://cursor.com/install | bash`), executes base64-decoded per-agent probe script blocks, and allows arbitrary extra bash injection via `E2E_EXTRA_ENSURE_BASH`. If an attacker can tamper with environment variables or the agent-matrix.json (or upstream matrix data), this becomes a direct arbitrary code execution/supply-chain compromise vector. No clear evidence of steganography/obfuscation or direct theft is present in this snippet, but the supply-chain execution primitives are strong.

This module is designed to execute scenario-based shell scripts in a Docker environment and includes an explicitly dangerous remote execution pattern: it downloads a payload from INSTALLER_URL and pipes it directly into bash (curl -fsSL "$INSTALLER_URL" | bash). Because INSTALLER_URL and related parameters come from environment variables (and script content is assembled as executable shell), the main security risk is supply-chain/remote installer compromise or command injection if environment values are tampered with. No direct evidence of stealthy malware (e.g., keylogging, exfiltration to a specific domain, persistence mechanisms) is visible in this snippet, but the remote code execution capability makes the overall risk high for hostile environments.

SUSPICIOUS: 该技能的能力与“安装/配置数据采集工具”这一目的基本一致，没有明显把凭证转发到无关第三方，也明确禁止用户把 AK/SK 发给 Agent；这降低了恶意性判断。但其核心安装、卸载和 Linux 7U 补丁都通过远程 OSS 脚本直接 pipe-to-shell 执行，且要求完整权限环境，存在显著供应链与执行信任风险。再加上该产品本身会进行数据采集与上报、并修改本地配置，整体风险中高。未见明确恶意窃密或隐藏外传指令，因此更适合判为可疑/高风险技能，而非确认恶意。

This module is primarily an E2E configuration deployment utility that conditionally writes/merges local Codex and Claude proxy configuration files into the user’s home directory. It does not show overt malware behaviors like networking or exfiltration in the provided fragment, but it does: (1) execute a base64-decoded embedded Node helper to modify user config files, and (2) persist a proxy API key from environment variables to disk. The main security concerns are supply-chain/abuse risk from embedded code execution and secret persistence, plus potential unintended configuration corruption due to regex-based merge logic.

The code primarily implements configurable end-to-end probes for AI CLIs and does not itself show clear malware. It contains significant security-sensitive mechanisms: environment-controlled global npm installation, arbitrary shell execution through eval, configurable API endpoints, and exposure of credentials in command-line arguments. These mechanisms are plausible for a test harness but should be restricted to trusted environments and sanitized inputs. No intentional obfuscation or direct malicious payload is evident in the supplied portion.

This module functions as a covert telemetry/recording interceptor: it globally patches fetch for /v1/messages requests, parses request 'system' instructions and streaming SSE response metadata (message id and time-to-first-token), and writes the captured content to local disk under an environment-derived intercept directory. While there is no explicit remote exfiltration in this fragment, the sensitive data capture plus global interception behavior makes this a high privacy/security concern and potentially malicious or unauthorized logging depending on the integrating application’s consent and controls.

This fragment is a security-sensitive loader/interceptor mechanism: it probes the local filesystem for a “host runtime”, then dynamically imports and executes that module, and may install interception hooks based on derived host metadata. While there is no direct evidence of malware (e.g., exfiltration, credential theft, network calls) in the snippet, the dynamic import + hook installation based on filesystem discovery makes it potentially high impact if resourceRoots/runtime selection can be influenced or if the discovered files are attacker-controlled. Review unseen helpers (candidateResourceRoots, classifyHost, installInterceptHooks) and validate whether discovery is restricted to trusted, integrity-checked locations and allowlisted filenames.

Moderate supply-chain concern. The snippet clearly performs install-time filesystem mutation (creating an 'intercept.js' stub under a user cache directory) and executes a local migration module dynamically to alter a local config.json. No explicit exfiltration/credential theft or direct command execution is visible in this fragment, but the intercept/instrumentation-like artifact name and the install-time dynamic import increase the need to inspect the missing parts: the exact legacyIntercept path construction, how/if intercept.js is consumed later, and the contents/behavior of migrate-internal-config.js.

This is a launcher intentionally designed to preload a token-interception module into a Qoder CLI. The wrapper itself shows no direct network exfiltration, credential harvesting implementation, or destructive behavior, but the omitted preload module is a high-impact trust boundary because it can access CLI tokens and process data. The two eval statements also create a potential shell-injection risk if LOONGSUITE_QODERCLI_FLAVOR is attacker-controlled or contains shell metacharacters. The preload module and its file-writing behavior must be reviewed before use.

The code is a deliberate interception and logging mechanism rather than ordinary JSON utility code. It does not exfiltrate data over the network or execute commands, but it persistently captures system prompts and token metadata to a local file and modifies global JSON behavior. This constitutes a significant privacy and supply-chain risk if introduced without clear authorization, especially in applications handling confidential prompts or credentials.

This PowerShell fragment is a fail-open dispatcher/launcher: it locates a Node.js binary (prioritizing a pinned path and scanning user-managed version directories) and executes a bundled Node module with a passthrough subcommand, suppressing stderr and returning '{}' on most errors. No explicit malware indicators (network calls, credential theft, persistence, or direct obfuscated payloads) are present in the wrapper itself. However, the design creates an indirect supply-chain/runtime trust risk: if an attacker can tamper with the pinned node-bin file or the discovered node.exe in version-manager directories, this wrapper can execute a trojaned runtime and then delegate to the (unverified) local Node module. Final malware likelihood cannot be ruled out without reviewing workbuddy-hook-event-writer.mjs and verifying node-bin/node.exe integrity.

This module is designed to execute arbitrary bash scripts provided via opts.script, captures their output, and writes logs/artifacts to disk. While consistent with e2e orchestration, it also includes a helper that kills specific processes and restarts a service, which could be harmful if the script/inputs are not tightly controlled. The main security concern is the high-impact execution sink (bash -c) and partial/heuristic secret redaction when writing artifacts. No explicit malware/backdoor mechanisms are visible in this snippet beyond the orchestrator behavior; however, misuse could enable sabotage or data exposure via artifact/log collection. Overall, this should only be used in trusted test environments with strict control over script content and output directories.

No explicit malware, exfiltration, or credential theft is demonstrated in this snippet; it is a Windows-only test harness. The main security-relevant concern is that it executes copied hook scripts via PowerShell using '-ExecutionPolicy Bypass', which reduces script execution safeguards, and the true behavior depends on the external hook assets (not shown here). This should be reviewed at the hook asset level, but based on this fragment alone the probability of malware is moderate and the most actionable risk is execution of potentially untrusted script content.

This wrapper itself does not show overt malicious actions (no network calls, credential access, persistence, or file writes in the provided fragment). Its main security concerns are structural: it executes a local bundled JavaScript processor using a dynamically resolved node.exe, and it can be coerced to run a pinned node binary path from a user-writable location with only a superficial version check. Additionally, stderr/output and exceptions are suppressed, reducing auditability. The true malware/intent cannot be assessed without reviewing qoderwork-hook-processor.mjs; prioritize inspecting that module for stdin handling, network behavior, and any sensitive data processing.

No direct evidence of classic malware behaviors (no network, no subprocesses, no obvious credential theft). However, the module loader performs dynamic import of a local dist/index.js path determined by unsanitized pointer-file contents and environment-influenced cache paths, without any integrity verification. If an attacker can write/poison the pointer files or influence the cache/data directories, this can enable arbitrary code execution within the Node process. Crash logs may also leak local error details to anyone with access to the log directory.

This is an end-to-end test orchestration script with a significant security weakness: it uses eval to execute each line of a local .env.e2e file. If .env.e2e is modified or substituted by an attacker, it can lead to arbitrary command execution in the host runner context. No direct malicious payload (e.g., exfiltration/backdoor) is evident in the provided snippet, but the eval pattern combined with loading high-value credentials into the environment makes the overall security risk moderate-to-high for compromised configuration scenarios.

This module is not obviously malicious on its own (no explicit theft/exfiltration/persistence), but it is a high-risk shell-execution harness. It executes a hook script based on caller-provided hookPath and then executes a verbatim command string derived from hook stdout or payload.tool_input via `spawnSync('bash', ['-c', ...])`, while also forwarding the entire parent `process.env` into the subprocess environment. If any upstream component or input can be influenced by an attacker or a compromised dependency, this design enables arbitrary command execution and potential secret exposure.

No explicit malicious code is present in this Docker Compose YAML fragment (it is configuration-only). However, it materially increases supply-chain and execution risk by running a privileged container (privileged: true), injecting many high-value secrets/tokens into the container environment, mounting repository content, and including flags that plausibly drive network/authenticated actions and remote configuration writes. Treat the overall setup as high-risk until the Dockerfile and container entrypoint/scripts are reviewed to verify there is no exfiltration, backdoor behavior, or unnecessary privileged access.

This code is a high-risk command-construction helper: it converts caller-provided text directly into a bash execution payload by base64-decoding and running it with `bash -s`. There is no explicit evidence of malware (exfiltration/persistence) in this fragment, but the capability to execute arbitrary bash makes misuse with untrusted input a serious remote code execution risk. Security posture depends entirely on strict upstream trust/validation of `probeCmd` and the context in which the returned string is executed.

This module is a high-impact local loader that dynamically executes an on-disk updater module determined by (1) an environment-controlled cache directory and (2) unvalidated pointer-file contents. If an attacker can write to the cache/pointer file or influence LOONGSUITE_PILOT_CACHE_DIR, it can enable arbitrary code execution. No explicit network exfiltration or credential-stealing behavior is visible in this snippet; the primary risk is trust boundary violation leading to code execution from tampered local files.

No explicit malicious payload is visible in this JSON configuration alone (no inline obfuscation, credentials, or network endpoints). The primary security concern is structural: it enables event-driven execution of an external shell script resolved via $PILOT_DATA and influenced by user-local hook/trust files. With sensitive events like UserPromptSubmit and broad matching (matcher:"*"), compromise of the hook script or path/trust inputs could lead to telemetry/privacy violations or arbitrary code execution. This should be reviewed by inspecting the referenced .sh hook and validating integrity/permissions of $PILOT_DATA and ~/.codex.

This fragment is a configuration for a Claude Code hook in 'hook' deployment mode. It specifies local settings/input locations, triggers on several agent lifecycle/tool-use events, and executes a provided shell hook script from $PILOT_DATA. The only notable unusual behavior is runtime interception/instrumentation (OpenTelemetry-related names), which is plausibly legitimate but high-impact because it enables arbitrary script execution. No explicit malicious logic (exfiltration, credential theft, backdoor behavior) is present in this JSON alone. Verify the contents of the referenced hook shell script to confirm it does not collect or transmit sensitive data.

This fragment is declarative configuration that enables a powerful local plugin injection/override mechanism by loading a plugin from file://$PILOT_DATA/plugins/openclaw and replacing specified plugin specs, including a concrete plugin module (plugin.mjs). The fragment itself contains no explicit malicious logic, network activity, or obfuscation, but it creates a substantial supply-chain risk surface: if $PILOT_DATA contents or ~/.openclaw config are tampered with, the host framework could load attacker-controlled code. Risk should be mitigated via strict filesystem permissions, integrity verification/provenance for injected plugins, and auditing of the referenced plugin module’s contents and the framework’s injection behavior.

This fragment is a high-impact Cursor hook configuration: it enables execution of an external shell script on a wide range of sensitive agent and IDE lifecycle events and references a local history/log directory that could contain prompts, agent reasoning, and tool traces. The snippet itself shows no credentials, obfuscation, or explicit network endpoints, but it creates a strong delegation point where malicious telemetry or exfiltration could be implemented in the referenced shell script. Security review should focus on the integrity/provenance of $PILOT_DATA/hooks/cursor-loongsuite-pilot-hook.sh and how it handles event/context data and logs.

No direct malware is present in this snippet because it is declarative configuration only. However, it configures a high-privilege plugin-injection mechanism that loads code from a local file path (file://$PILOT_DATA/plugins/opencode/plugin.mjs) and can replace existing plugin specs. This should be reviewed by inspecting the referenced plugin.mjs and the host’s plugin-inject logic for persistence, execution, and data handling.

This fragment is not executable payload code; it is a high-sensitivity plugin-injection configuration that directs the host to load and potentially execute a local JavaScript module from file://$PILOT_DATA/plugins/mimo-code/plugin.mjs and to override specific plugin identifiers. While the snippet shows no explicit malicious behaviors (no network calls, credentials, or obfuscation), it exposes a supply-chain/tampering risk typical of runtime code loading. Security depends on whether the injected plugin artifact is protected (integrity pinning/signing), how $PILOT_DATA is provisioned, and whether permissions prevent substitution.

This JSON configuration primarily enables configuration-driven execution of external shell scripts on a "Stop" event, using local user settings (~/.qoderwork/settings.json) and hook-jsonl history logs ($PILOT_DATA/logs/qoder-work/history) as behavioral inputs. The fragment itself shows no explicit credential theft, network activity, or obfuscation; nonetheless, it represents a meaningful supply-chain/local-execution risk because it instructs the host to run scripts from $PILOT_DATA/hooks/ and uses a broad matcher ("*") that could increase trigger frequency/impact. Security assessment should therefore focus on validating the integrity/provenance of the referenced hook scripts and the host’s invocation logic (including PowerShell wrapping).

This JSON configuration itself contains no malicious logic, but it enables event-driven execution of an external shell script and is triggered on user_prompt_submit, implying possible handling of sensitive prompt content. The main risk is tampering or malicious behavior in the referenced hook shell script (and possibly the user-writable settings file). Without inspecting $PILOT_DATA/hooks/grok-build-loongsuite-pilot-hook.sh and the hook framework’s data-passing/integrity controls, malware and exfiltration cannot be ruled out.

This JSON manifest itself does not show direct malicious logic, obfuscation, or network exfiltration. However, it configures an event-driven hook that executes an external script from a runtime/data directory when sensitive events (including UserPromptSubmit) occur, with broad matching and reliance on user-writable settings. The main risk is supply-chain/local-tampering of the referenced hook script and the potential handling (logging/forwarding) of prompt/history data by that script.

This fragment is not malicious code by itself; it is a configuration that enables a host-controlled plugin injection workflow. The primary security concern is that the injector is directed to load an external .mjs entrypoint from a runtime data directory and to create/modify the agent’s extensions configuration in the user’s home directory. If $PILOT_DATA/plugins/pi-coding-agent/index.mjs is tampered with or untrusted, it can result in arbitrary code execution by the agent. Verify the integrity/provenance of the referenced plugin module and ensure the plugin directory is protected against replacement.

No explicit malicious behavior is present in this configuration fragment alone (it contains no network calls, credentials, or payloads). However, it configures a hook that executes an external script on the "Stop" event, using local persistent settings and JSONL history inputs, with a wildcard matcher that may broaden the scope of processed data. Because the executed script contents and settings schema/handling are not included, the security posture cannot be verified; review and integrity-check $PILOT_DATA/hooks/qwenworkcn-loongsuite-pilot-hook.sh and validate what portions of the JSONL/settings are passed to it.