sesame

SUSPICIOUS. The documented API-call workflow is plausible, but the skill is not actually narrow: it authorizes a much broader `sesame` command surface with secret scanning/migration, machine trust changes, proxy installation, and MITM-style brokered egress. The broker-centered data flow and disproportionate capabilities are inconsistent with a simple authenticated-request skill, even though the specific static prompt-injection and copy/paste findings are mostly benign documentation artifacts.

The fragment is documentation for an auto-updating deployment and CLI system. It contains no direct malicious code or evidence of data theft, but automatic background installation and use of a mutable container tag create meaningful supply-chain risk if updates are not authenticated, verified, pinned, or transparently disclosed. Further review of the updater and installer implementation is required.