ablate-ai-layer

This module itself does not show clear embedded malware (no exfiltration, credential theft, or obfuscated payloads). However, it is inherently security-sensitive because it executes external programs and, when --runner is provided, enables shell=True with a user-controlled command string—an arbitrary command execution risk with full host privileges. It also saves the full prompt to disk and modifies .gitignore, which can cause unintended data persistence and repository changes.