workspace-dashboard

No explicit malware behavior (credential theft, exfiltration, reverse shell, or cryptomining) is evident in this module. However, it performs security-sensitive operations that materially affect supply-chain/workspace integrity: it dynamically executes a local Python module (sanitize-theme.py) via exec_module and it executes bash helper scripts from within the provided workspace directory (discover-plugins.sh and check-dependencies.sh). If an attacker can tamper with the installed package files or the workspace contents/scripts, this can lead to arbitrary code execution under the tool runner’s privileges. Separately, theme token handling includes an unsanitized google_fonts_import string inserted into CSS (@import), creating a potential external resource loading surface if theme/design inputs are attacker-controlled.