neuralos

SUSPICIOUS: the skill is broadly consistent with a headless RTerm/neuralOS operations backend, so it is not fundamentally deceptive, but its footprint is extremely expansive and high-impact. It combines autonomous remote execution, credentialed integrations, external content ingestion, background services, and real-world actions, making it a high-risk skill even without clear evidence of malware.

Overall, the code functions as an administrative remote automation client: it connects to a configurable WebSocket gateway, reads existing scheduler settings, and then pushes a new scheduled task whose command is a PowerShell AV signature update (Update-MpSignature). The main security concern is the high-impact remote configuration write that results in later PowerShell execution by the backend/scheduler; misuse depends on gateway trust and server-side authorization. No clear evidence of stealth, obfuscation, or direct data theft is present in this snippet, but the capability to schedule PowerShell remotely warrants careful trust boundary review.

This PowerShell module is an installer/persistence utility rather than an obvious in-file malware payload: it does not contain credential theft or obfuscated logic. However, it introduces meaningful supply-chain and operational risk by performing an unpinned npm global install at runtime and then creating a persistent, aggressively auto-restarting scheduled task that launches the installed backend. It also configures the service to listen on 0.0.0.0:17888, increasing exposure if authentication/TLS is not robust in the backend.

No overt local malware behavior is evident in this file (no exec/eval, no filesystem writes, no direct credential theft or network exfiltration). However, it delegates operational actions to a remote agent via free-form, command-like userInput and determines CI pass/fail solely from remote UI text, creating meaningful supply-chain/trust and integrity risk if the WebSocket endpoint or remote agent is not fully trusted. Additionally, the absolute-path fallback when requiring 'ws' is an unusual environment-specific anomaly that warrants review for packaging correctness and unintended behavior.