autopilot

SUSPICIOUS: the skill is internally coherent as an automation/orchestration tool, but it grants an AI agent broad autonomous execution by spawning headless provider CLIs with approval and sandbox bypass flags. There is no clear credential-harvesting or exfiltration behavior in the snippet, but the autonomy level, repository mutation, and transitive dependence on other skills make it high security risk.

No strong indicator of embedded malware is present in this fragment (no obvious backdoors, credential theft, or exfiltration code). The dominant concern is high operational risk: the runner executes provider CLIs with explicit safety/sandbox/approval-bypassing flags and selects the executed binary via environment variables. If an attacker can influence runtime environment or config, this design could enable significant compromise. Additional risk could come from unshown helper functions (path safety and sanitize_message effectiveness).