jarvis-starter

The described scaffold exhibits multiple high-risk design patterns typical of insecure or loosely implemented extensions across browsers and IDEs. While there is no demonstrated malicious behavior in the fragment itself, the architecture enables potential data exposure, privacy violations, or data leakage if implemented without proper mitigations. A thorough code-level review focusing on manifest permissions, CSP enforcement, content-script scope, message validation, and secure storage usage (prefer chrome.storage and explicit data minimization) is required before release.

This fragment appears to be a legitimate, idempotent local installer that creates executable JARVIS hooks and registers them in .claude/settings.json, optionally seeding memory and applying an archetype overlay. Within the provided code, there is no direct evidence of malware (no network exfiltration, credential theft, or obfuscated payloads). The primary security concern is that it intentionally forwards untrusted host event content (hook INPUT) into other locally executed bash scripts, and it injects additional execution triggers via sed—so the overall risk depends on the safety and integrity of the referenced downstream core scripts and archetype addon files.

The fragment signals notable security and reliability risks despite benign intent: unvalidated localStorage save/load, potential memory leaks from improper destruction, and missing rigorous asset preload/validation. Recommend implementing: (1) strict validation and integrity checks for saved game state (sanitization, versioning, schema migrations); (2) robust destroy patterns and lifecycle management to prevent memory leaks; (3) explicit asset preload verification with fallback defaults; (4) input handling hygiene for mobile and safe defaults for interaction edge cases; (5) consideration of minimal data minimization for localStorage (avoid storing sensitive data). No malware indicators detected; risk is moderate and focused on client-side persistence and lifecycle robustness.

SUSPICIOUS: the skill’s capabilities mostly align with its stated purpose as a persistent project assistant, but it installs durable hooks, requires shell-script execution, modifies Claude settings, and introduces transitive trust through third-party skill installation. No clear credential theft or hostile exfiltration is shown, so this is not confirmed malware, but it carries meaningful security and autonomy risk.