vibe

SUSPICIOUS: the skill’s orchestration behavior broadly matches its stated purpose, but trust is weakened by reliance on a repo-local Python runtime with unclear maintained distribution and provenance. No direct credential harvesting, exfiltration endpoint, or remote installer is shown here, so this looks more like a high-trust workflow skill with medium supply-chain and execution risk than confirmed malware.

No direct, self-contained malware behavior is evident in this fragment (no exfiltration, backdoor, or credential theft code paths). The primary security concern is orchestration-level risk: it executes a PowerShell bridge with '-ExecutionPolicy Bypass' and passes untrusted inputs (prompt and host decision JSON) as command arguments, plus it reads artifact-referenced JSON files with insufficient consistent path confinement. If an attacker can tamper with artifact roots/summaries or influence referenced artifact paths, it could lead to unintended file reads and/or escalation depending on bridge behavior. Overall: likely legitimate orchestration with meaningful security posture and attack-surface concerns.

SUSPICIOUS: the skill is mostly coherent for scientific slide creation, but its default workflow sends prompts, citations, and attached local figures to OpenRouter, a third-party gateway, creating meaningful confidentiality and credential-forwarding risk. No clear malware behavior or deceptive installer is present, but users should treat attached research materials as data leaving the local environment.

SUSPICIOUS. The core software-building purpose broadly matches many capabilities, and official Anthropic/GitHub tooling references are credible. However, the skill’s actual footprint is high risk because it is explicitly designed for unattended autonomous execution with permission bypass, dynamic discovery/use of unverified MCP plugins, transitive skill trust, and optional remote GitHub publishing. This is not confirmed malware, but it is a high-risk autonomous agent skill.

SUSPICIOUS: the core documentation purpose is coherent and mostly benign, with no direct malware behavior or clear exfiltration path in this file. The main concern is the mandatory dependency on another skill, which expands trust and possible PHI exposure beyond the stated clinical-writing scope; combined with Bash access, this makes the skill medium risk rather than benign.

SUSPICIOUS. The core CDS-writing purpose is benign and largely aligned with the requested tools, but the skill is not self-contained: it mandates a second skill and local script execution for figures, with incomplete provenance and evidence of potentially outbound/networked behavior in the referenced tooling. Risk is driven more by transitive trust and possible credential/data forwarding than by the document-generation instructions themselves.

No explicit malicious logic (e.g., credential theft, network exfiltration, persistence, or obfuscated payloads) is present in this Python test harness itself. However, it executes local repository PowerShell scripts using `pwsh -ExecutionPolicy Bypass` and a dynamically constructed `-Command` string (including dot-sourcing a helper script), creating a high-impact supply-chain/execution-risk surface if any referenced `.ps1` files or imported modules are compromised. Review the invoked PowerShell scripts and any transitive dependencies for malicious behavior.

SUSPICIOUS. The core peer-review guidance is mostly coherent and looks documentation-like, but the skill expands into transitive use of another skill and optional AI schematic generation that introduces Bash execution, external API use, and credential handling beyond the main review purpose. Data flow appears to go to an official provider rather than a clear exfiltration endpoint, so this is not confirmed malware, but the transitive trust and scope expansion make it medium risk.

No explicit malware behavior (e.g., credential theft, reverse shells, or hardcoded malicious endpoints) is evident in the provided snippet. However, the code implements a high-impact autonomous pipeline that generates a startup script, later executes it and runs tests, then commits and pushes changes and can create GitHub issues/releases. The primary security concern is structural supply-chain risk: if the spec/inputs or generated artifacts are attacker-controlled, the workflow can execute and publish compromised code to a remote repository chosen via unvalidated repo_url. Additional review is required of the omitted initializer/builder run implementations and the generated init.sh and test steps to determine whether any malicious activity exists beyond orchestration.

SUSPICIOUS：核心 Git 反思提交功能与其文件读写、Git 命令基本一致，未见明显恶意载荷或凭据窃取；但技能要求自动发现并使用外部 MCP 工具，且可直接执行提交、amend、创建 issue、推送远程，带来中等真实副作用与传递信任风险，超出单纯“生成报告”所需的最小范围。

SUSPICIOUS: the skill’s core purpose is coherent, and there is no obvious malware behavior or download-execute chain. The main concern is data-flow integrity: all model access and optional research appear to be brokered through OpenRouter, so prompts and credentials are exposed to an intermediary rather than official first-party APIs. Risk is moderate, not because the capability is unrelated, but because third-party routing and external-content ingestion increase confidentiality and prompt-injection exposure.

No clear evidence of intentional malware (tracking, credential theft, or covert exfiltration) is present in the provided fragment. The main security concern is a credible command-injection risk: the migration script executes attacker-influenced values (repo_url and feature text from local JSON) via subprocess.run(..., shell=True) inside dynamically constructed command strings. Additionally, the workflow’s rollback guidance includes destructive git history rewriting (reset --hard / optional push --force), which can cause significant integrity damage if misused or triggered with incorrect inputs. If this is distributed as supply-chain tooling, it should be reviewed and refactored to avoid shell=True with interpolated strings (use argv arrays, strict quoting/escaping, and input validation) and to add safety rails around destructive git operations.

No direct evidence of intentional malware (no exfiltration, backdoor/persistence, or dynamic execution). However, the module is security-sensitive: it unpacks untrusted DOCX ZIP files with zipfile.ZipFile.extractall() without path validation (ZIP Slip/path traversal/overwrite risk) and optionally invokes LibreOffice (soffice) on untrusted .doc content (external parser/converter attack surface). Additionally, it may be vulnerable to resource/disk amplification via large or maliciously structured documents because extracted text is written extensively to JSON/Markdown.

SUSPICIOUS: the stated purpose is coherent, and the requested API keys and file access are broadly proportional to paper-to-media conversion, but install trust is weak because the skill published by K-Dense Inc. directs users to clone and run a separate personal GitHub repository with unpinned code and then provide API keys to it. No clear malicious or covert exfiltration behavior is shown, but the publisher/source mismatch and credential forwarding make this a medium-risk skill.

No clear indicators of intentional malware are present (no obfuscation, no suspicious execution, no evident external exfiltration beyond the intended OMERO API connection). The dominant risk is security misuse: hardcoded administrative credentials, cross-group enumeration, and user impersonation (suConn), combined with verbose printing of identity/session/permission metadata and loading full raw file bytes into memory. Treat this as privileged/demo code requiring strict control and safer secret/logging practices before reuse.

No explicit malicious actions (network exfiltration, shelling out, credential theft) are evident in this fragment. The primary security concern is that it dynamically imports and executes a local module (workspace_memory_driver.py) at runtime, and it performs file reads/writes directly to paths provided by CLI arguments without path confinement. If the local module or package directory can be tampered with, this could enable arbitrary code execution; otherwise, the code appears to function as a benign file-backed broker with medium integrity/control risk.

No direct evidence of malware (e.g., hardcoded secrets, explicit exfiltration endpoints, or backdoor logic) is present in the shown fragment. The dominant security concern is supply-chain and misuse risk: the automation pattern instructs runtime installation/execution of third-party MCP servers via npx -y and enables high-impact capabilities (filesystem access to {{PROJECT_DIR}} and desktop mouse/keyboard control), with browser-context evaluation that can perform network requests. Without visible version pinning, integrity verification, strict permission scoping, and input/log sanitization, this should be treated as a security review priority rather than low-risk documentation.

No evidence of stealthy malware (no network/exfiltration, no credential theft, no obfuscated payloads) was observed in this module. The dominant security concern is operational and supply-chain-adjacent: when given a `.tex` file, it executes `pdflatex` via `subprocess.run` in the input file’s directory without sandboxing or explicit hardening, which can lead to unsafe filesystem side effects and potentially dangerous TeX behaviors depending on the environment. PDF/PPTX parsing adds secondary risk for malformed inputs. Overall: likely safe for trusted inputs, but risky for untrusted LaTeX unless sandboxed and hardened.

SUSPICIOUS: the core MarkItDown install path is benign and purpose-aligned, but the skill expands scope by recommending a separate skill and by routing optional AI features through OpenRouter, a third-party gateway that receives keys and document-derived content. Overall this looks like a legitimate documentation skill with moderate supply-chain and data-flow risk rather than confirmed malware.

No explicit backdoor/malware behavior is observable in this module (no eval/obfuscation/credential theft/exfiltration mechanisms shown). However, the module is inherently high-risk for supply-chain attacks: it fetches/clones a repository from a configuration-defined repo_url, destructively resets the local checkout to a fetched commit, and then executes repository-provided scripts (check.sh/check.ps1) and installer logic (run_installer_core). If repo_url/upstream content is compromised or attacker-controlled and if cryptographic verification/pinning is not enforced elsewhere, this could enable arbitrary code execution during upgrade/reinstall. Review should focus on enforcement of trusted remotes, pinned commits or signatures, and safe handling of repo_root/canonical_root resolution in the surrounding system.

SUSPICIOUS: the core Obsidian note-saving purpose is coherent, and the explicit GitHub backup feature is proportionate, but the skill expands scope by mandating proactive ToolSearch and immediate use of discovered MCP plugins. The main risk is unintended data exposure through automatic GitHub sync or broad MCP-assisted enrichment, not confirmed malware or deceptive credential theft.

No direct evidence of credential theft, network exfiltration, cryptomining, or explicit malicious payloads is present in this script itself. However, it performs high-impact dynamic execution by dot-sourcing provider modules whose paths/behavior are derived from a registry JSON file, and it clears/restores environment variables around that execution. If the registry or referenced modules were tampered with (supply-chain risk), this script could execute arbitrary code during the gate run. Primary risk is therefore indirect: malicious modules in the dependency/provider set can gain execution via dot-sourcing, and the gate provides little verification for non-01-openai-responses modules beyond side effects.

This module appears to be a functional GitHub-based installer that fetches and installs arbitrary repository content chosen by user input. It does not show overt malware behavior (no exfiltration, credential theft, or hidden execution) within the provided code. The security risk is mainly supply-chain and operational: it executes git based on user-controlled ref/paths, downloads and extracts third-party ZIP archives, and then copies untrusted directories into the local filesystem after only minimal validation (SKILL.md presence). ZIP extraction includes a basic boundary check against path traversal, but additional archive safety (symlink/hardlink/resource exhaustion) and stronger integrity verification (commit pinning/signatures/hashes) are not evident in this module.

The snippet does not show overt malware (no clear backdoor, credential theft, network exfiltration, or obfuscated payloads). However, it repeatedly launches an external autonomous agent ('claude') with an explicit '--dangerously-skip-permissions' flag and persists stdout/stderr to disk without visible sanitization. This combination materially increases operational/security risk: if the invoked tool or its inputs are compromised, the script can amplify impact through repeated retries and store potentially sensitive outputs in logs. Review the full file (especially helper function implementations and how $BuilderDir/$LogFile permissions are handled) and ensure the 'claude' binary and its skill/inputs are tightly controlled in a trusted environment.

This fragment is best characterized as an autonomous-operation supervisor/launcher. It contains no direct malware patterns (no eval/obfuscation, no credential theft, no network exfiltration) in the bash logic itself, but it intentionally runs a highly privileged autonomous agent in an unattended loop using `--dangerously-skip-permissions`. That design choice materially increases security risk because any compromise, unsafe action, or abusive behavior by the invoked agent/skill or project context will be executed automatically and persistently. Additional minor risk comes from brittle grep-based JSON parsing and reading /tmp/autonomous_restarts without validation.

This module is primarily a LibreOffice headless recalculation wrapper, but it also conditionally writes a LibreOffice Basic macro (Module1.xba) into the user’s LibreOffice profile directory and then invokes it via vnd.sun.star.script. That combination (persistent host modification + Office/LibreOffice macro execution) is a strong security red flag for supply-chain risk because the macro payload can potentially execute arbitrary actions in the LibreOffice process context. The provided fragment is incomplete around macro_content, so the exact payload cannot be verified here; treat this as high-risk and require inspection of the actual macro content and packaging process, ideally in a sandbox.

This Python file is a test/orchestration harness that executes a local PowerShell runtime with "-ExecutionPolicy Bypass" and validates governance/lineage artifacts produced by that runtime. No direct malware indicators (credential theft, network exfiltration, persistence, obfuscation) are present in this Python snippet itself; however, the security risk is elevated because it runs external code through a bypassed execution policy and relies on external stdout JSON to locate and read filesystem artifacts. Actual threat presence cannot be determined without inspecting the invoked PowerShell script and its imported modules.

The shown code primarily performs local file generation from CLI/config inputs. While it does not show explicit exfiltration or credential theft, it contains a high-risk pattern: it can write an output file and mark it executable (chmod 0o755) while embedding Bash-script-like content that could incorporate untrusted inputs (e.g., --content). Additionally, filename sanitization for args.title appears incomplete, which may allow unsafe path behavior. The fragment is also broken/incomplete (undefined symbols/methods), so behavior must be verified in the complete source before trusting the package in security-sensitive workflows.

SUSPICIOUS: The skill's purpose is plausible and its credential scope is proportionate, but the actual API base URL is inconsistent with Adaptyv's documented official endpoints. Using a generic AWS Lambda URL for bearer-token and experiment submission materially weakens data-flow integrity and install trust, so this should not be treated as benign without verification from Adaptyv that the Lambda URL is an official API front end.

SUSPICIOUS: the stated purpose matches discovery/installation of skills, but the trust model is weak. Its main risk is transitive skill installation from a third-party marketplace (`prompts.chat`) into `.claude/skills/` with no described signature, checksum, or publisher verification, allowing unreviewed instructions/scripts to become trusted local skills.

This is a configuration-only fragment for an autonomous build supervisor. It does not contain explicit malware behavior (no networking, credentials, or payload execution directives). The primary security concern is a high-risk policy flag (dangerously_skip_permissions=true) that could weaken permission enforcement in the consuming automation layer, potentially enabling unintended filesystem access or actions despite safety constraints and protected path lists. Logging to local .builder/* files may also persist sensitive build outputs depending on what the runtime writes to logs.

This code is a high-risk dynamic loader: it reads another Python file (pack.py) from a computed relative path, modifies sys.path to affect module imports, and executes the loaded contents via exec with __name__='__main__'. Maliciousness cannot be confirmed without inspecting pack.py, but the execution trampoline and import-resolution manipulation materially elevate supply-chain risk.

This module is a thin runtime loader/runner that reads a specific Python file from a parent-relative path, adjusts sys.path, and executes the file’s contents via exec(). The fragment provides no explicit malicious payload, but the use of compile+exec on filesystem content and sys.path manipulation are high-risk supply-chain/tampering indicators. The effective security risk is primarily contingent on whether docx/ooxml/scripts/validate.py is trustworthy and protected against modification in the build/distribution environment.

This file is a high-suspicion dynamic loader: it locates a neighboring internal script using filesystem traversal, modifies sys.path, then reads and exec-compiles another Python file with no integrity verification. The wrapper itself does not demonstrate malicious intent, but it creates a critical supply-chain/tampering risk because any alteration of the referenced unpack.py would be executed immediately with the user’s privileges. Security depends entirely on the integrity and safety of the external unpack.py that it loads.