sealos-deploy

SUSPICIOUS. The skill’s deployment, registry, cluster, and runtime-verification capabilities largely match its stated Sealos deployment purpose, and most data flows go to official Sealos/GitHub/Docker/Kubernetes endpoints. However, the mandatory use of kubectl with --insecure-skip-tls-verify is a serious integrity issue, and the skill has meaningful cloud-mutation and supply-chain footprint. Not malware, but medium-to-high security risk for operational use.

The excerpt describes a legitimate-looking device-authentication and workspace workflow, but disabling TLS verification and allowing an unvalidated REGION to receive bearer tokens pose material credential-theft risks. Treat REGION as trusted only after validating it and avoid -k for authentication requests. No clear evidence of intentional malware is present.

The code implements a Docker build-and-push utility. The main security issue in the visible code is potential shell command injection through an unsanitized registry username interpolated into execSync. Use argument-based process execution or strictly validate and escape the username.

The code performs a Launchpad network check but sends the locally read kubeconfig to a host derived from a configurable region URL. This may be intended authentication behavior, yet the unbounded destination and broad credential disclosure create a significant security risk. The snippet does not establish malicious intent, but the destination should be constrained and credential scope minimized.

The code has a plausible administrative purpose, and no clear malware or unrelated data exfiltration is present. However, untrusted command-line values are incorporated into a shell command without robust escaping, creating command-injection risk; shell expansions in credential values are also not neutralized. Kubernetes TLS verification is disabled. Validate or strictly constrain arguments, avoid `sh -c` by passing arguments directly to `execFile`, and retain TLS verification.

The script has a command-injection risk: unvalidated command-line scope values are interpolated into shell commands passed to execSync(). Validate allowed scope syntax and use spawn/execFile with an argument array rather than shell command strings. The code otherwise appears intended to manage GitHub CLI scopes; this fragment alone does not establish malicious intent.