mission-control

No direct, explicit malware (e.g., crypto-mining, reverse shell, keylogging) is evident in this snippet. However, it has a high security risk due to multiple DOM XSS sinks (innerHTML/template-literal rendering of task fields and GitHub-provided content without escaping) combined with storing a GitHub PAT in localStorage. Successful XSS would likely enable token theft and unauthorized repository modification. Additionally, the code includes a gateway-based cron execution trigger, which is high-impact if an attacker can influence gatewayUrl or cron-related data.

SUSPICIOUS: The skill is largely coherent for task orchestration, but it materially expands the agent from tracking tasks into autonomous execution triggered by webhooks and status changes. Credential needs and network flows are mostly purpose-aligned, yet the auto-run behavior, broad repo access, and weaker publisher/install trust make this a high-risk workflow skill rather than a benign dashboard-only tool.