folder-curator

No direct indicators of intentional malware are present in the shown automation fragment (no obfuscation, credential theft, command-and-control, or overt destructive behavior). The primary security concern is operational/data risk: outbound synchronization uses `rclone copy -L`, which can follow symlinks and potentially upload out-of-scope or sensitive target contents despite path-based excludes. Inbound pulls untrusted Drive files into the repository and triggers `folder-curator reindex`, increasing downstream impact depending on that tool’s parsing safety. Additionally, per-file metadata (paths/names/hashes) is emitted via `bb-emit`, which may disclose sensitive structure to its recipient system. Overall: likely legitimate automation, but with moderate supply-chain/data-disclosure risk that warrants review of symlink handling, event destination controls, and ledger.json integrity.

No explicit backdoor, credential theft, or obfuscated payload execution is present in this module. However, it functions as an exfiltration-capable forwarder: it posts untrusted NATS JetStream message payloads verbatim to an arbitrary, environment-configured HTTP webhook and ACKs only on 2xx responses. The main security risk is unintended data leakage via webhook misconfiguration/compromise and the resulting retry/forward loop behavior.