oh-pr-workflow

SUSPICIOUS. The workflow is largely aligned with its stated OpenHarmony PR purpose, and its token/API use is broadly proportionate, but it automatically runs an unseen local setup script for MCP tooling. Because that installer/toolchain is not verifiable from the skill and then handles GitCode credentials and outbound PR operations, the main risk is supply-chain and credential forwarding rather than confirmed malicious behavior.

This fragment appears to be an installer and MCP registration script rather than clear malware. It performs intentional configuration persistence and exposes a GitCode token to the installed local MCP server. The unsafe interpolation of token and path values into Python source is a genuine injection and configuration-corruption risk, although malicious exploitation is not established from the visible code. The installed binary remains the highest-impact omitted component and requires separate review.

No direct malicious code is present in the supplied README. The described tool has legitimate PR automation purposes but handles a high-privilege GitCode token, installs a bundled or compiled MCP service, modifies agent configuration, and can force-push repository history. These are material supply-chain and operational risks requiring review of setup.sh, the MCP source, the precompiled binary provenance, and the DCP script before use. The fragment alone does not demonstrate malware.

The code appears to be legitimate MCP server initialization and transport setup. No direct malware, credential exfiltration, command execution, obfuscation, or destructive behavior is present. The main security concern is that SSE mode binds to all interfaces without visible authentication or TLS, potentially exposing registered MCP tools and API-backed functionality to unauthorized network clients. The severity depends on the behavior of the registered tools and deployment network controls.