investigate-alert

SUSPICIOUS. The skill’s purpose and capabilities mostly align with OpenShift alert investigation, and it uses expected cluster/admin tooling. The main concern is the unreviewable local scripts plus eval-based environment setup, which creates execution-trust risk and could expose monitoring credentials or run unintended shell code if the repo is tampered with. No clear exfiltration endpoint, credential harvesting flow, or unrelated capability is shown, so this is not confirmed malware.

This is a general-purpose shell helper file, not evidently malware. Its Prometheus request disables TLS certificate verification and sends a bearer token to a destination assembled from unvalidated values, creating a meaningful credential-disclosure risk if the configuration or path is attacker-controlled or traffic is intercepted. Validate the destination and enable certificate verification.