ast-deobfuscation

该 skill 与其声明目的基本一致，未见凭据收集、外部数据转发或可疑安装链，因此不像恶意窃密型技能；但它为 AI 代理提供了面向反爬/风控脚本的定向反混淆与逆向能力，属于高风险安全工具范畴。总体判定为 SUSPICIOUS：不是明显恶意，但能力本身超出普通开发辅助，且可用于规避站点保护。

This module is primarily a pipeline orchestrator. There is no direct evidence in the shown code of malicious payloads, obfuscation, credential theft, or network exfiltration. The main security concern is execution risk: it synchronously runs external step scripts (step.scriptPath) determined by pattern/config selection and passes all parent environment variables (process.env) to those child processes. If pattern selection or pipeline configuration can be influenced by untrusted input, or if step scripts are compromised, the overall package behavior could become dangerous. This wrapper should be treated as medium-to-high risk in supply-chain contexts until the safety of pipeline-config and step scripts is verified.