implement-issue-tree

SUSPICIOUS. The skill is purpose-aligned for GitHub workflow automation and mainly talks to official GitHub endpoints, so it does not look malicious. However, it grants an AI agent high-impact autonomous repository actions—push, PR creation, issue closing, and opt-in merging—while processing untrusted GitHub content, making it a high operational-risk skill despite coherent intent.

The visible code appears to be a purpose-built GitHub/Git automation workflow rather than malware. It performs powerful repository and GitHub mutations, including push, PR creation/editing, worktree deletion, issue closing, and optionally squash merging, so it has substantial operational security risk. The code includes unusually extensive fail-closed validation and untrusted-data handling, and no credential theft, suspicious network destination, persistence, destructive unrelated behavior, or covert exfiltration is evident. The supplied fragment is syntactically truncated, preventing complete verification of the driver logic.

No direct malware behavior is evident in the shown harness logic (no network, persistence, or obvious secret theft). However, the module performs high-sensitivity dynamic code execution by extracting awk and bash programs from Markdown (skillMd) and running them via execFileSync (/bin/bash -c and awkProgram execution). If skillMd is not strictly trusted (e.g., attacker-modifiable at runtime or part of a vulnerable supply chain), this design represents a potential RCE vector. In the current context it appears to be deterministic test scaffolding, which reduces likelihood of real-world abuse, but the execution primitive remains the dominant security concern.