offload

SUSPICIOUS: the skill’s purpose matches delegation/orchestration, but it deliberately launches external builder agents with relaxed or disabled approval controls and supports arbitrary custom commands. There is no clear credential theft or exfiltration path in the skill itself, so it is not confirmed malware, but it is a high-risk autonomy and execution wrapper.

This excerpt is a process/command orchestration script that injects $BLOCK and other config-derived values directly into commands executed via herdr/tmux/Terminal or (for custom) bash -c. It also intentionally disables/weakens tool safety controls using “dangerously-bypass-approvals-and-sandbox” (codex) and “dangerously-skip-permissions” (claude). No clear exfiltration/keylogging/backdoor is visible, but the direct input-to-execution wiring and permission bypass create a high security risk if any of the inputs (CANDIDATES/custom/BLOCK/env/config) are attacker-influenced.