kernelgen-flagos

SUSPICIOUS: the stated purpose is mostly coherent for GPU kernel tooling, but the skill has moderate trust gaps. Its behavior depends on unseen sub-skills and a mandatory unspecified MCP backend, and its declared permissions are broad while the required MCP tools are not actually listed in allowed-tools.

No explicit malicious behaviors (exfiltration, credential theft, backdoor installation, cryptomining) are shown in the provided fragment because it is a high-level pipeline description. However, it performs high-impact supply-chain actions: it may auto-install dependencies (including editable install of the repo) and it sends existing operator code to an MCP service and directly writes MCP-returned code back into FlagGems operator sources that will be executed by pytest. Without integrity checks/sandboxing/allowlisting of MCP output, this creates a plausible avenue for sabotage via compromised MCP service or returned code. Recommend reviewing the MCP transport/authentication, add code signing/integrity checks for generated code, and implement strict validation/sandboxing before writing and executing modified operators.