brain-scan

SUSPICIOUS. The skill's broad local access is mostly coherent with its purpose as a local skill-evaluation loop, and the Harbor install path appears official. The main risk is credential handling: it reads local Claude/Codex auth files and forwards tokens into containerized runs, which is sensitive even though the documentation explicitly warns against third-party cloud providers and keeps the intended flow local.

The code is an evaluation harness with an intentionally powerful shell verifier and LLM-based judging. It does not show clear malware, backdoors, credential theft, or destructive behavior. The main security concerns are execution of an untrusted verify string via bash -c, inheritance of environment secrets, possible path traversal through brief id/sample values, and disclosure of collected artifacts to the LLM backend. The supplied fragment is syntactically invalid because JUDGE_PROMPT has no value.

The code is a task-generation utility with a high-impact dynamic execution boundary in knowledge-gap mode. LLM-generated verify_py is executed via bash with the current user's privileges, so a malicious model response, prompt-injection result, or compromised forge_llm implementation could execute arbitrary commands. Context files are also sent to the configured model. The fragment shows no explicit credential theft, persistence, destructive behavior, or network exfiltration, but it should be treated as unsafe when model output or input JSON is untrusted. The shown syntax is incomplete and would fail to import as provided.

SUSPICIOUS. The skill’s capabilities mostly match its stated benchmarking purpose, and no direct exfiltration or remote installer is visible. The main concern is trust in opaque vendored local scripts processing sensitive session logs without clearly verifiable first-party provenance, which creates moderate supply-chain and privacy risk rather than confirmed malicious behavior.

No clear malicious payload or covert supply-chain behavior is present. The script is an evaluation harness that intentionally executes commands and AI agents. It presents a significant security boundary risk when briefs, skills, or agent prompts are untrusted, especially because setup is run via bash -c, Claude has Bash access, some Codex modes bypass approvals, and a Codex authentication file is exposed to the agent. Use only with trusted evaluation inputs and stronger network and credential isolation.

The fragment is intended as a model-assisted draft generator, not clear malware. It contains a meaningful path-write vulnerability because --name is used without validation and can potentially escape the configured output directory. It also forwards local context and evidence to forge_llm, which is a potential data-disclosure boundary dependent on that module's implementation. As shown, the code does not run because DRAFT_PROMPT lacks a value. Review forge_llm.call_model and constrain --name to a safe basename before use.

The code appears to be a skill-candidate discovery and ranking utility, not an overt malware payload. Its main security concern is supply-chain risk from executing unpinned packages via npx -y, plus possible disclosure of cluster signature terms to remote search services. Restrict network access, pin and verify package versions, and treat input/output paths and cluster contents as untrusted.

This is a legitimate deployment and verification script with no clear malware indicators. It has a medium-severity command-injection risk in the remote mode because REMOTE_ROOT and skill names are inserted into ssh command strings without robust shell escaping. Restrict these values to validated path components and use safe argument passing or quoted remote scripts. Confidence is high for the findings; malicious intent is unlikely.