agenthub

This module itself is not visibly malicious or obfuscated, but it contains a high-impact security design flaw: it executes a user/config-provided eval_cmd via subprocess.run(..., shell=True) with cwd set to a git worktree path. If an attacker can influence --eval-cmd or the per-session config.yaml content, this becomes a straightforward arbitrary command execution vector. Additionally, config.yaml is read from a path constructed using an unvalidated session_id, which can pose an unintended file read/path traversal risk depending on caller constraints.