epic-captain

SUSPICIOUS. The skill’s capabilities largely match its stated orchestration purpose, so it is not confirmed malware, but it creates a high-risk trust envelope: autonomous merge-capable repo operations, high-privilege GitHub auth, issue-tracker credentials, and delegation of repo context to external AI CLIs while processing untrusted review/issue content. Official tooling provenance reduces supply-chain concern, but the overall operational risk remains high.

No explicit malware/backdoor behavior is visible in this Bash orchestration script. However, it has meaningful supply-chain/security risk: it executes an AI agent with “--dangerously-skip-permissions”, copies a local .env.local (possible secrets) into the PR worktree used for changes, dynamically sources a config file as shell code, and uses a local Linear API key for network calls. These design elements could be abused in a compromised pipeline context, even though there is no direct evidence of intentional sabotage or data exfiltration beyond standard GitHub/Linear API usage.

This fragment itself looks like an automation controller and does not obviously contain direct malicious payload behavior. However, it has high-impact execution sinks: it dot-sources a local config file and executes two local helper scripts (fix-pr.sh/subreview-pr.sh) in the background. If an attacker can modify the config or helper scripts (or the working directory), the bot could run arbitrary code. The snippet also relies on local `.state` files for review substitution gating, which could be abused if those files are writable. Overall: low evidence of explicit malware here, but meaningful supply-chain/execution risk due to dynamic trust of local code and configuration.

No clear, explicit malware/backdoor is present in this snippet (no hardcoded credentials, no suspicious network endpoints, no eval/obvious process-spawning of attacker-supplied commands). However, the script is a high-privilege automation wrapper: it sources a local config file (code-exec sink), copies .env.local (secret exposure risk), symlinks node_modules into a worktree (dependency execution amplification), and delegates merge/commit/push actions to codex/claude with workspace-write and a 'dangerously-skip-permissions' flag in fallback. This creates substantial supply-chain risk if an attacker can influence config/repo content or the executor environment/prompt, even if the snippet itself is not overtly malicious.