orchestrate

SUSPICIOUS. The skill's behavior is mostly coherent with a worker-orchestration purpose and the scanner hits are largely benign documentation artifacts, but the core control path requires executing an unverifiable local script (orchestrate.sh) whose provenance is not established in the skill. No clear credential harvesting, exfiltration, or deceptive routing is present from the text shown, so this is not malicious, but it carries medium risk due to trust in an undocumented local executable plus autonomous detached workers.

No clear in-snippet malware (no direct exfiltration/backdoor), but the script has high supply-chain/security risk due to executing arbitrary shell code from profile and meta files via ". \"$f\"" and then using profile-controlled launch commands to spawn processes. Additionally, built-in agent launch commands include permission/sandbox bypass flags and the tool auto-accepts first-run trust dialogs when patterns match. Overall: treat as potentially dangerous if $ORCH_HOME or profile/meta files are not strictly trusted and protected.