agentcookie-install

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt instructs the agent to read the pairing "code" and "pair_url" from ~/.agentcookie/pairing.json and embed them verbatim into the SSH/agentcookie command sent to the sink, which requires the LLM to handle and output secret pairing tokens directly.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This content describes a tool and step-by-step workflow that explicitly copies Chrome session cookies from a "source" Mac to a "sink" Mac (over Tailscale/SSH), installs persistent LaunchAgents, and avoids Keychain prompts — behavior that enables credential theft, silent data exfiltration, and persistent remote access and is therefore high-risk and abusable as a backdoor.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill runs "go install github.com/mvanhorn/agentcookie/cmd/agentcookie@latest" on both source and sink at runtime, which fetches and builds/executes remote code from that GitHub module and is required for the install flow.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill instructs installing binaries, writing persistent config and LaunchAgent service files, and starting daemons (including via SSH on a remote host), which clearly modifies the machine's state and deploys persistent services.