iblai-vibe-os-agent-code-mode

SUSPICIOUS. The skill's powerful file-editing and command-running behavior fits its stated coding-assistant purpose, and most network endpoints are first-party or official. The main concern is proportionate but high-risk execution trust: it downloads and runs an external opencode binary, syncs mutable release content, opens a LAN pairing service, and forwards a scoped API key into agent-controlled code. This is coherent developer tooling, not confirmed malware, but its footprint is large enough to warrant a high-risk classification.

The fragment appears to be legitimate coding-agent transport and sandbox orchestration code, with no clear malware or covert supply-chain attack. The principal security risks are intentional high-privilege subprocess execution, automatic permission approval, broad filesystem read access, arbitrary caller-selected workspace paths, PATH-based executable resolution, credential exposure through `IBLAI_API_KEY`, and verbose logging of ACP traffic. These risks warrant review of Tauri command exposure, authentication, sandbox assumptions, and production logging before deployment.

The fragment is primarily a deliberately designed local credential-isolating proxy, not apparent malware. Its strongest risks are credential exposure through debug logging and plaintext key persistence, plus possible DM-token exfiltration if an untrusted caller can supply the upstream base URL or session registration data. The hardcoded domains and token-minting behavior are consistent with the stated service integration, but upstream URL validation and secure storage should be verified in surrounding code.

The fragment implements a legitimate auto-installer and updater with no clear malicious behavior, data exfiltration, credential theft, persistence, or backdoor functionality. The principal security issue is trusting and executing GitHub-hosted binaries and installing downloaded skill files without checksum or signature verification. Archive extraction also lacks an explicit path-traversal and symlink safety validation layer. These are meaningful supply-chain and archive-handling risks, but the code does not itself demonstrate malicious intent.

The code implements a legitimate remote opencode hosting and pairing feature. It contains no clear malware, obfuscation, credential harvesting, covert exfiltration, or backdoor behavior. It does create a powerful network-accessible code execution service by design; the use of HTTP on 0.0.0.0, password exposure through status/QR flows, absolute path disclosure, and token-bearing requests to an optional api_base require trusted UI access, secure pairing, and validation of the API base. The fragment alone does not establish exploitation, but these are material security concerns.