agenthub

SUSPICIOUS: the skill’s core behavior is mostly consistent with its stated purpose, but it gives an AI coordinator broad autonomous control over spawning agents, executing eval commands, reading untrusted agent outputs, and merging code. The main concern is operational risk and prompt-injection exposure rather than confirmed malware; install trust is only mildly concerning due to the ClawHub syntax mismatch, not hostile provenance.

This module itself is not visibly malicious or obfuscated, but it contains a high-impact security design flaw: it executes a user/config-provided eval_cmd via subprocess.run(..., shell=True) with cwd set to a git worktree path. If an attacker can influence --eval-cmd or the per-session config.yaml content, this becomes a straightforward arbitrary command execution vector. Additionally, config.yaml is read from a path constructed using an unvalidated session_id, which can pose an unintended file read/path traversal risk depending on caller constraints.