create-agent-template

This fragment describes an authorized-looking CI/CD automation workflow that passes an SCM token to a plugin and enables repository writes and pull-request creation. It is not evidence of malware by itself, but it creates a significant supply-chain risk if the truncated container image is untrusted, compromised, or overly privileged. The token should be narrowly scoped, masked, and used only with a trusted pinned image and appropriate approval controls.