deepworkplan

SUSPICIOUS. The addon's behavior is mostly coherent with its stated purpose, but it materially expands trust by installing a separate agent skill/CLI and enabling autonomous team reporting. Risk is driven by transitive skill installation and remote installer paths, not by confirmed malicious behavior.

SUSPICIOUS: the core file access and validation behavior fit a plan-execution skill, but the unattended autonomous execution, shelling out based on plan/task content, multi-repo commit capability, and transitive dependency on the separate dailybot skill materially increase risk. No direct malware or obvious credential theft is shown, but this skill gives an agent substantial power to make persistent code changes and relay summaries through another skill.

This entrypoint is not overt malware (no network exfiltration, no backdoor commands, no dynamic execution), but it is security-sensitive: it seeds/persists CLI authentication/session state by copying config into named-volume-backed directories and symlinking real tool paths to them, and it can copy private SSH keys from a mounted source into a writable `.ssh` directory. If the surrounding repo is malicious or if `.ssh_host`/volume mappings are compromised, this behavior could facilitate credential theft and persistent access. Review the repo’s intended mounts/permissions and verify that key material is trusted.