disaster-recovery

SUSPICIOUS: the skill’s core purpose is legitimate disaster recovery, but it handles extremely sensitive data, weakly 'encrypts' secrets, includes an SSH key, reaches outside its claimed backup scope, and supports restore from arbitrary URLs. The data flows mostly go to official services and broadly fit the stated purpose, so this is not confirmed malware, but its footprint is broader and riskier than a narrowly scoped backup skill should be.

No malware behavior is demonstrated because executable code is not provided. However, the fragment contains plaintext OAuth credentials—especially refresh_token and client_secret—in a JSON artifact, with notes indicating repeated token refresh and write-back. This creates a high likelihood of credential compromise and unauthorized upstream access if files are leaked, committed, or included in distribution artifacts.