senhasegura

SUSPICIOUS. The skill is largely coherent with its stated senhasegura integration purpose and uses official vendor domains/APIs, so it does not look malicious. However, it instructs use of a vendor CLI outside a standard package registry, forwards OAuth credentials into that CLI, and writes fetched secrets to local files by default; those choices create elevated supply-chain and secret-handling risk even though the overall data flow matches the product's intended workflow.

The YAML does not itself show clear malicious intent, but it contains significant secret-handling and pipeline-integrity risks. In particular, avoid exposing production secrets to pull-request builds, do not source the generated secrets file, safely validate and transport secret values, and pin and verify the DSM CLI release.

The code implements an MCP bridge to a credential-management service. It does not show evidence of covert exfiltration or other malware, but it intentionally exposes privileged secret retrieval and SSH-key rotation operations to MCP callers. Restrict access to the MCP server, use least-privilege API credentials, ensure the base URL is trusted, and validate or encode path parameters.

This workflow is not inherently malicious, but it has material supply-chain and secret-handling risks. Pin and verify the DSM CLI, avoid fetching secrets for untrusted pull-request builds, validate the generated variables file rather than sourcing it, and limit secret availability to trusted steps. The secret-configured API destination and exposure of credentials to repository-controlled build code require particular care.