ruflo

No direct malicious code is visible in this fragment (no obvious obfuscation, hardcoded credentials, or explicit malware behavior). However, it implements a high-impact “LLM tool calling → privileged execution” autopilot loop where tool names/arguments come from untrusted model output, enforced only by a narrow regex blocklist and lacking schema/authorization validation in the shown code. It also stores and exposes tool results via an endpoint and streams summaries over SSE, creating a potential sensitive-data disclosure risk if tools return secrets. Overall, this module presents a significant security risk primarily due to unsafe trust in model-driven tool execution and incomplete access control for stored tool outputs.

SUSPICIOUS: the skill’s purpose broadly matches hook automation, but it grants a third-party CLI wide authority over command hooks, persistent memory, metrics, and agent orchestration. Install source is moderately trustworthy via npm/same-ecosystem evidence, yet the automatic shell-hook execution and parameter interpolation make the overall footprint higher-risk than a typical formatting or session helper.

SUSPICIOUS: the skill’s overall purpose matches hook automation, but it gives a third-party CLI broad automatic control over edit/bash/session workflows and forwards operational data into external MCP/memory systems. Same-org provenance reduces malware confidence, yet the stale install path, expansive scope, and command-string interpolation make this a medium-high security risk rather than benign.

No direct evidence of intentional malware, data theft, or network exfiltration is present in this module. However, it performs high-impact local code execution by enumerating and executing discovered local CLI binaries and by invoking npx for @claude-flow/cli. In a compromised environment (tampered node_modules/global installs, dependency confusion, or manipulated cache/paths), this creates a realistic supply-chain/local-tampering risk of arbitrary code execution. Secondary risks include shell-based git/SQLite subprocess invocation and cache/promo poisoning that could mislead users, but these are lower likelihood than the execution risk.

SUSPICIOUS: the core GitHub management purpose is legitimate, but the footprint is broader than a simple guidance skill because it combines untrusted GitHub content ingestion, Bash, write access, third-party npm execution, and autonomous repo/project mutations. Main risks are indirect prompt injection from issue/comment content and supply-chain trust in external swarm tooling rather than confirmed malware.

SUSPICIOUS: The skill is broadly aligned with release management, but its scope is powerful and includes autonomous publishing/deployment plus credential use across third-party orchestration tooling. No confirmed malware or hidden exfiltration is evident, yet the combination of alpha npm CLIs, optional MCP/swarm components, and real-world release actions makes this a medium-to-high operational security risk.

SUSPICIOUS. The skill’s capabilities largely match GitHub release management, and most network destinations are official service endpoints. The main risk is trust expansion: extensive use of unpinned `npx claude-flow`/`@alpha` in workflows that also possess publish tokens and release permissions, plus broad autonomous publishing/deployment actions. This looks coherent for release automation but carries meaningful supply-chain and credential-forwarding risk.

SUSPICIOUS: the core GitHub review purpose is plausible, but the skill mixes third-party `npx` execution, untrusted PR/comment ingestion, and autonomous PR actions. The webhook example is the strongest issue because it turns PR comments into shell-executed commands; overall this is a high-risk automation skill rather than confirmed malware.

SUSPICIOUS: the skill’s GitHub review purpose is plausible, but its footprint is broader than necessary because it funnels PR data and potentially GitHub credentials into an unpinned third-party npm tool, processes untrusted PR/comment content, and enables autonomous repo actions including reviews, pushes, and merge-related operations. Official GitHub CLI usage is benign, but the third-party `ruv-swarm` dependency and command-executing webhook pattern materially raise risk.

SUSPICIOUS: The skill is internally coherent for a platform-management skill, and the referenced service domains/publisher relationship look consistent. However, it grants an AI agent broad high-impact capabilities—remote code execution, deployment, storage, credential handling, and billing/auto-refill—so the overall footprint is large and risky even without clear malicious exfiltration patterns.

No clear evidence of intentional malware, obfuscation, or direct data exfiltration is present in this workflow fragment. However, it is inherently high-impact and security-sensitive: it performs automated rollback by resetting/committing/tagging and pushing (with an emergency force-with-lease path), and its automated rollback target selection relies on heuristic commit-message matching plus a fallback to HEAD~1. The workflow_dispatch inputs (especially rollback_target and emergency_mode) further increase abuse/misconfiguration risk unless tightly permissioned with strong branch protections. Primary recommendation is to enforce strict access controls and tighten rollback target selection logic to reduce the chance of unintended or malicious historical states being pushed.

SUSPICIOUS: the skill’s core orchestration purpose matches its capabilities, and the main install path appears to use an official same-project npm package, so this is not confirmed malware. However, it materially increases agent risk by combining external-content research, autonomous workflow triggers, deployment/test execution, and explicit offensive security scanning patterns; the unpinned `@alpha` package also adds supply-chain exposure.

SUSPICIOUS: the skill’s capabilities generally match GitHub workflow automation, but its footprint is broader and riskier than a simple guide because it routes sensitive repo context and credentials through third-party `npx` tooling, includes alpha dependencies, and enables autonomous GitHub/deployment actions. No direct credential exfiltration or overtly malicious endpoint is shown, so this is not confirmed malware, but it carries meaningful supply-chain and automation risk.

SUSPICIOUS. The skill is largely coherent with its stated orchestration purpose and uses verifiable same-project install sources, so it does not look malicious. However, it grants broad orchestration power, uses mutable alpha installs, and includes security-testing plus external-content processing patterns that raise meaningful operational risk for an AI agent.

No explicit in-snippet malware (no eval/exec, no system command execution, no obvious network exfil to hardcoded external hosts) is visible. However, the MCP integration hooks persistently store full serialized CRDT state and delta history (ttl:0) and transmit sync/topology-derived data to metrics_collect and neural_patterns learning. This is a notable supply-chain/security risk because it may leak sensitive internal state and operational topology to an external tooling layer. The absence of key missing-method implementations reduces certainty, but the external state persistence + learning hooks are the strongest suspicious indicators.

SUSPICIOUS: The skill’s capabilities largely match its stated multi-repo GitHub automation purpose, and the main tooling (`gh`, `claude-flow`, `ruv-swarm`) has plausible same-org or official provenance. However, it grants very broad autonomous write/execution powers across repositories, includes transitive trust in external CLIs, and mixes untrusted repo content processing with shell execution and outbound actions, making the overall footprint high-risk even without clear evidence of malware or credential theft.

This file primarily orchestrates hook handling and delegates sensitive behavior to optional local helper modules and to a detached child process (local cli.js or npx/@claude-flow/cli). There is no explicit malicious payload in the shown fragment (no eval/Function, no direct exfiltration, no destructive actions), but it does introduce non-trivial security risk through (1) detached external code execution with stdio ignored, (2) npx-based tool execution (supply-chain/execution exposure), (3) require()-based loading of on-disk modules without integrity checks, and (4) potential sensitive logging of context derived from the input prompt.

SUSPICIOUS: the skill broadly matches a version-control/agent-coordination purpose and uses an official npm distribution path, but it relies on embedded native binaries and encourages autonomous execution of recommended operations. No clear credential theft or third-party exfiltration is shown, so this is not confirmed malware; main concerns are supply-chain trust and operational autonomy.

SUSPICIOUS. The skill broadly fits an AI-oriented version-control helper, but its footprint and claims are inflated, and install trust is weakened by reliance on an external jj binary with partly inconsistent provenance/documentation. I found no strong evidence of credential theft or exfiltration, so this is not confirmed malware, but it carries medium security risk from supply-chain and autonomy concerns.

SUSPICIOUS: The skill’s stated purpose generally matches its orchestration capabilities, and the install path appears to use the publisher’s npm/repo/site ecosystem. However, it asks users to install mutable third-party CLIs, forward credentials into them, and grants the agent operational cloud workflow powers with real-world effects; the unrelated binary alias further undermines trust. Overall this looks more like a high-risk external orchestration integration than confirmed malware.

SUSPICIOUS: the skill is mostly consistent with a multi-agent coordination purpose and uses a plausible same-ecosystem npm CLI, but it expands into high-impact orchestration patterns and includes offensive-security worker examples that are broader than necessary for a generic coordination guide. Main risk is operational breadth and trust in external CLI tooling, not confirmed malware or credential theft.

SUSPICIOUS: the skill’s core behavior matches its stated purpose, so it is not clearly malicious, but it has a medium-risk footprint due to broad Bash-enabled automation, multi-repo write capability, and npm install execution. Data flows stay mostly within official GitHub/npm tooling, with no obvious exfiltration or rogue proxy, but the autonomy and execution scope are larger than a minimal sync skill needs.

SUSPICIOUS: the skill's core capabilities fit its stated hosted neural-training purpose, and installer/domain ownership appears internally consistent. Main risk comes from executing an unpinned npm CLI, forwarding credentials through third-party CLI code, and sending model/data workloads to remote infrastructure that is not the official E2B toolchain.

SUSPICIOUS: the skill’s core purpose matches issue-based coordination, but its footprint is broader than necessary due to Bash/Write access, third-party npm CLIs, and autonomous GitHub issue actions triggered from untrusted issue/comment content. No confirmed malware or exfiltration is evident, but the combination of external tooling, action-taking authority, and prompt-injection exposure makes it medium risk.

SUSPICIOUS: the skill’s purpose is coherent for release automation, but its footprint is high-risk because lifecycle hooks automatically run unpinned external npm tooling and the skill can take autonomous real-world actions such as repo writes, release publication, and deployment. Data flows are mostly aligned with the stated purpose, so this is not confirmed malware, but it is a materially risky coordination skill.

SUSPICIOUS: The skill is broadly aligned with release management, and its network/data flows mostly target official GitHub and npm infrastructure. The main risks are high-impact autonomous repository actions plus unpinned runtime execution of `npx ruv-swarm` in hooks, which makes this a medium-risk release automation skill rather than confirmed malware.

SUSPICIOUS: the skill is broadly aligned with repository architecture and multi-repo management, but it couples that purpose to automatic unpinned `npx` hook execution and high-impact GitHub write actions. The main concern is supply-chain and execution trust rather than confirmed malicious intent.

SUSPICIOUS: the core purpose is coherent for a code-review skill, and GitHub CLI usage/data flow to GitHub are legitimate. The main risk comes from unpinned third-party npm execution (`npx ruv-swarm`), autonomous GitHub write actions, and analyzing untrusted PR content with shell/write-enabled agents; this is high operational risk but not confirmed malware.

SUSPICIOUS: the skill’s stated purpose mostly matches its coordination capabilities, and the visible GitHub usage is coherent with project orchestration. However, it authorizes autonomous external actions and references unverified underlying execution/network components without exposing script bodies or endpoints, creating medium security risk despite limited evidence of malicious intent.

SUSPICIOUS: the core GitHub Projects automation purpose matches most capabilities, and the gh-based data flow is generally coherent. The main risk is repeated execution of unpinned third-party `npx ruv-swarm` commands plus optional outbound webhook syncing, which expands trust beyond GitHub and npm without strong version pinning or provenance controls.

No direct, concrete malware behavior is evidenced in the provided snippet (no explicit backdoor logic, credential theft, or system-damaging actions). The dominant finding is elevated supply-chain and automation risk: it dynamically executes an npm tool via `npx`, installs dependencies from the npm registry, and runs `npm test` from multiple cloned repositories—then publishes changes across an organization via PRs/issues. This makes the workflow high-impact if any involved package/tooling or target repository is compromised, and webhook-driven propagation could further broaden attackability depending on how `ruv-swarm` validates and routes events. Review and harden version pinning/integrity for `ruv-swarm`, restrict CI execution permissions, and implement strict allowlisting/validation for event-driven propagation targets.

SUSPICIOUS: The skill’s GitHub/PR capabilities broadly match its stated purpose, but its footprint is high-risk for an agent skill: untrusted PR content can influence orchestration, Bash is available, and the skill can autonomously comment on and merge PRs. The third-party npx swarm tooling appears publicly sourced and same-ecosystem rather than clearly malicious, so this is better classified as high security risk than confirmed malware.

No direct, explicit malicious logic (e.g., reverse shells, credential harvesting, or obvious exfiltration endpoints) is visible in the provided workflow fragment. The primary security concern is supply-chain execution: the workflow runs an external npm package via `npx` in CI and then uses an authenticated GitHub token to post reviews and potentially approve/request changes. Additionally, PR state decisions are driven by keyword matching in tool output, which could lead to incorrect approvals if the tool output is influenced by PR content or tool behavior. Recommend auditing/pinning the exact npm package version (lockfile + integrity/provenance), limiting token permissions, and hardening approval logic (structured output/signatures rather than substring grep).

SUSPICIOUS: the core API-development purpose is plausible, but the skill’s footprint extends into automatic external learning/telemetry through npx claude-flow@alpha. The main concerns are mutable third-party execution and forwarding task context/output to an external CLI, which is only loosely proportionate to backend coding assistance.

No clear direct malware behavior (no credential theft, persistence, or file-destruction logic) is evident in this wrapper alone. However, the module is a high-impact execution dispatcher: it can fetch and execute `ruflo@latest` via npx at runtime, and it can execute an arbitrary binary specified by RUFLO_HOOK_CLI_OVERRIDE. Additionally, it forwards untrusted stdin content and extracted command/file/path values to the external tools, so the effective risk depends heavily on the trustworthiness of both the environment inputs and the downstream hook executables. Treat this as a significant supply-chain and arbitrary-execution risk area requiring strict control of env vars, network access, and the invoked hook binaries.

SUSPICIOUS: the skill is purpose-aligned with trading, but it promotes autonomous financial actions and remote code execution, creating high real-world risk. Its impossible light-speed/temporal-lead claims are misleading, and external MCP/sandbox data flows are insufficiently transparent, though there is no direct evidence of credential theft or malware in the skill text itself.

The module itself shows no explicit malicious payloads or data-theft logic, but it implements a high-impact runtime supply-chain mechanism: it may run `npm install` into a cache directory and then dynamically import and execute code from the installed package. Because the install command and import target depend on caller/environment-controlled values, strict allowlisting and integrity controls must exist outside this module; otherwise this becomes an external-code execution vector. Security risk is moderate-to-high due to runtime package fetch+execution and reduced integrity safeguards (no lockfile, no explicit verification).

SUSPICIOUS: the stated memory-architecture purpose is plausible, but the skill’s real footprint includes automatic hook-time execution of a mutable external npm package and forwarding task content into that CLI. This is more risk than necessary for a planning/documentation specialist, though there is not enough evidence to call it malicious.

No clear evidence of stealth malware, obfuscation, or direct data exfiltration within this JavaScript module itself. The primary security concern is that the module executes arbitrary repo-local shell scripts discovered under plugins/*/scripts/smoke.sh without sandboxing or integrity verification; if those scripts (or their dependencies) are compromised, arbitrary code execution can occur. Additionally, it propagates stdout-derived reporting and a tail of stderr, which can leak secrets if the smoke scripts print sensitive data.

No explicit malware behaviors (e.g., backdoors, credential theft, direct exfiltration, or obfuscated payloads) are visible in this wrapper module. The main security concern is supply-chain/runtime code execution: it invokes `npx` to download/resolve and run `metaharness-darwin` at runtime, forwards merged environment variables and an optional caller-provided `cwd`, and enables `shell` on Windows. Additionally, JSON/argument handling depends on unseen helper implementations (`injectJson`, `parseTrailingJson`) that could affect robustness. Overall, treat this module as a medium-to-high supply-chain execution risk wrapper rather than clear malicious code.

No explicit malicious behaviors (network calls, filesystem access, credential theft, eval/Function, or subprocess execution) are present in this module’s local numerical code. However, the package includes a high-impact integration/execution hook: it conditionally executes a runtime-provided function from globalThis['mcp__ruflo-sublinear__solve'] (optionally forced by process.env.RUFLO_SUBLINEAR_NATIVE) and passes full matrix/vector data into it. This creates a meaningful supply-chain/runtime tampering risk if that global is attacker-influenced or comes from an untrusted source. Strengthen trust boundaries (allowlisting/provenance), improve error handling/logging, and verify who registers the global tool before use.

This module is primarily a test harness, not a runtime library. Its key security-relevant behavior is executing hook commands obtained from generated settings.json via shell interpreters (sh -c / cmd.exe /c). The heuristic validation reduces some obvious risky patterns but is not a robust allowlist, so the sink remains high-impact if configuration can be influenced. No concrete malware behavior (network exfiltration, persistence, or explicit data theft) is evident in this snippet.

This fragment does not itself contain explicit malicious payloads, but it sets up a high-risk execution model: local helper scripts are invoked on many lifecycle events, and an MCP server is started by dynamically fetching and executing ruflo@latest via npx. Combined with a broad tool allowlist that includes write-capable git operations, any compromise or malicious logic in the referenced helpers or the fetched dependency would have amplified impact. Review and pin the npx dependency (avoid floating @latest), and audit the referenced local .claude/helpers/*.cjs/*.mjs implementations for network access, credential access, and unsafe persistence/exfiltration behavior.

No direct in-module malware mechanisms are evident (no eval/new Function, no obvious credential theft, no direct network sockets). The primary risk is security/supply-chain exposure: the module can execute an npm package at runtime via npx using environment-selected specifiers like @latest/@alpha, and it forwards aggregated session metadata to that external CLI as an argument. Additionally, environment variables can redirect which JSONL file is read (TRACK_SESSION) and where the summary is written (TRACK_OUT). Overall, this is low likelihood of standalone malicious payload in this file, but medium security risk due to runtime external execution and data handoff.

This module is not obviously malicious on its own; it primarily indexes ADR markdown files and optionally imports derived records/edges into an external memory backend. The main security concern is supply-chain/execution risk: it runs an unpinned npm package via npx using moving tags ('@latest' / '@alpha') selected by environment variables, and it forwards untrusted ADR content as command-line arguments to that external tool. Treat this as a high-impact trust-boundary expansion rather than self-contained malware.

SUSPICIOUS. Most content is benign security guidance, but the skill auto-executes a third-party unpinned prerelease CLI (`agentic-flow@alpha`) and forwards task data to it. That install-and-run behavior is not necessary for a security-architecture skill and creates disproportionate supply-chain and outbound data-flow risk.

This module is a local supply-chain/integrity tampering utility: it patches an installed dependency in node_modules to inject a message-pruning function and changes how z.messages are processed, using env vars to control pruning/truncation. No clear malware indicators (no networking, command execution, credential theft, or exfiltration) are present in this code. However, the high-impact nature of in-place dependency modification and the unreliable PATCH_MARKER check (empty string always matches) make it a security-relevant operation that should be reviewed and controlled in trusted environments.

SUSPICIOUS: The core purpose matches PR management, and GitHub CLI usage is consistent with that purpose, but the skill combines shell execution, repo-script execution, untrusted PR/repo content handling, and autonomous approve/merge actions. Main risk is high-impact automation and execution scope, not confirmed malware or credential theft.

No explicit malware behavior (data theft, persistence, crypto-mining, or destructive actions) is demonstrated in this fragment. However, the provided integration patterns create meaningful security risk: (1) comment-driven control of a swarm handler invoked via npx, (2) a webhook example that uses execSync to run an npx command using externally supplied data without shown validation/escaping, and (3) privileged GitHub side effects (labels/comments/reviews/auto-merge) that can be indirectly influenced by untrusted PR/webhook/comment inputs or tool outputs. Overall, treat this as a high-impact command-execution/control-plane design that requires strict input validation, command whitelisting, and hardened CI/webhook security controls.

No clear in-module malware behavior is evident (no eval/Function usage, no direct network exfiltration, no filesystem writes). The primary security concern is supply-chain/execution risk: this module runs `npx` at runtime to execute a package selected by an environment variable (defaulting to a moving `@latest` spec). That behavior can download and execute untrusted code if the environment or npm supply chain is compromised. Secondary issues include brittle regex-based stdout JSON extraction and a broader command-surface on Windows due to `shell: true` in spawnSync.

SUSPICIOUS. The skill’s examples are broadly consistent with a memory-backend migration guide, and there is no direct evidence of malware, hidden execution, or credential theft in the skill body. Risk comes mainly from the external/transitive install path and the fact that local memory data would likely be centralized into an external AgentDB service if followed in practice.

SUSPICIOUS. The skill’s capabilities fit its payment purpose, but it enables autonomous financial actions and demonstrates raw private-key handling through an unspecified MCP backend. With no documented endpoint, publisher linkage, or key-management safeguards, the main risk is opaque credential/data routing rather than confirmed malware.

This module does not show intrinsic malicious payload behavior (no eval/obfuscation, file tampering, or direct exfiltration), but it is a high-impact execution wrapper. It forwards unvalidated CLI arguments and stdin directly to external binaries, and it can dynamically fetch/execute `ruflo@latest` via npx unless explicitly disabled—creating a meaningful supply-chain/time-of-execution risk. Windows `shell: true` further broadens execution semantics risk.

This Bash module itself implements local benchmarking (filesystem scans, local process inspection, and JSON updates) with no direct evidence of embedded malware, exfiltration, or destructive behavior. The dominant risk is supply-chain execution: it repeatedly runs an unpinned npm package via `npx agentic-flow@alpha`, and the `deep` command spawns a background agent with unconstrained task execution and no sandboxing. If the npm dependency or registry resolution is tampered with, attacker-controlled code could run with the permissions of the user executing this script.

SUSPICIOUS: the stated purpose is coherent for swarm orchestration, but install/execution trust is weakened by package identity mismatch and unverified hook commands. This looks more like a risky third-party CLI integration than confirmed malware; the main concern is running an NPX-fetched package whose relationship to the referenced official tooling is unclear.

SUSPICIOUS: the skill's purpose is coherent, but its execution trust is weakened by an installer/publisher mismatch and unpinned `npx` runtime execution of third-party code. No direct credential harvesting or overtly malicious behavior is shown in the skill text, but the provenance inconsistency makes it medium risk rather than benign.

SUSPICIOUS: The stated payment-management purpose matches the capabilities, but the skill enables high-impact financial actions through opaque MCP backends and lacks explicit approval guardrails. No direct malware behavior or credential theft is shown, yet the combination of autonomous payment operations and limited backend transparency creates meaningful security risk.

SUSPICIOUS: the skill’s behavior broadly matches its stated swarm-orchestration purpose, but it depends on an external MCP/cloud platform, forwards tasks and potentially secrets to that platform, and enables high-autonomy remote actions. Same-ecosystem npm provenance lowers malware confidence, yet unpinned `npx` execution and credential-bearing cloud workflows keep overall risk at medium.

No explicit malware or exfiltration logic is present in this configuration snippet itself. However, it creates a high-risk execution surface by dynamically requiring a local hook module from an environment-controlled path (CLAUDE_PLUGIN_ROOT) during security-sensitive editor/agent phases where command/file modifications are expected. If CLAUDE_PLUGIN_ROOT is not strictly controlled, this can enable arbitrary code execution. Additionally, the accompanying claims about fail-open behavior and permission-verdict stdout shaping (if implemented in the referenced scripts/ruflo-hook.cjs) are security-contract red flags and should be verified in the actual module.

SUSPICIOUS: the skill’s purpose matches its capabilities, but it outsources core security analysis to an unpinned external CLI executed via npx and references undisclosed remediation scripts. This is not confirmed malware, yet it is a high-risk agent skill because it gives the agent active security-audit/remediation power and relies on third-party executable code with incomplete data-flow transparency.

SUSPICIOUS: the capability set matches a sandbox-management skill, but the data path appears to run through a third-party Flow Nexus MCP layer that may receive code, files, and secrets intended for E2B sandboxes. This is proportionate to the purpose but increases trust and credential-forwarding risk because the skill does not clearly scope what secrets are sent or document direct official endpoint usage.

No clear indicators of direct malware (no obfuscated payloads, no credential theft, no in-module exfiltration, no destructive filesystem/network operations). However, this module repeatedly executes a remote npm package via spawnNpxSync (npx-style) with a runtime-selected specifier (including 'latest' and 'alpha' tags) and passes user-influenced namespace/key into external command arguments. On Windows it enables shell mode, which can magnify command-argument handling risks depending on spawnNpxSync. The main risk is supply-chain/integrity and command-execution argument-safety rather than overt malicious behavior in this code.

No direct malicious payload is evident in this fragment, but it carries a significant supply-chain and operational risk: it repeatedly executes `npx @claude-flow/cli@latest` (runtime moving dependency) and uses that authority to monitor status, dispatch worker jobs, and create persistent cron schedules. Actual malware likelihood depends on the integrity of the CLI and downstream workers, which are not shown here; review and pin versions, restrict dispatch/scheduling scope, and audit the CLI/MCP hook implementations.

No direct indicators of data theft or embedded malicious payload are present in this module’s logic. However, the dependency introduces significant supply-chain and host-execution risk by calling `execSync` to run `npx agentic-flow@alpha mcp status` at runtime. Because the invoked npm artifact is not pinned to an immutable version, a compromised or changed `alpha` tag could result in arbitrary code execution under the privileges of the running Node process. This should be treated as a high-risk operational behavior unless the execution environment is tightly controlled and the invoked dependency is pinned/verified elsewhere.

SUSPICIOUS. The skill’s stated purpose broadly matches its hook-based learning claims, but its actual footprint is thin and relies on executing a mutable `npx` alpha package while sending task metadata through an unspecified external path. The malformed SONA package reference and unclear data handling make it internally inconsistent enough to avoid a benign classification, though there is not enough evidence for malware.

No explicit evidence of classic malware (backdoor, exfiltration, credential theft) is present in the provided fragment. However, it describes an autonomous self-healing mechanism that can automatically run npm installs, execute npx hooks (runtime code fetch/execute), and apply agent-driven code fixes, with error-derived data stored for later behavioral influence. This materially increases supply-chain and unintended-change risk unless strong safeguards exist (locked/pinned dependencies, integrity checks, allowlisted commands/agents, sandboxed execution, strict confirmation/review gates, and protection against attacker-controlled inputs).

No explicit malicious payloads are evident in this fragment (it is a specification and includes no direct evidence of exfiltration, credential theft, or backdoors). The main security risk is supply-chain and dynamic code execution: the design instructs runtime execution of npm packages/plugins using `npx` with unpinned `@latest`, and defers additional operational behavior to ../REFERENCE.md tool catalogs. Additionally, it persists device trust history and enables neural-training hooks, expanding the impact of poisoned/malicious device inputs. Review/pin dependencies, inspect ../REFERENCE.md and the actual implementation of the agent/tool invocations, and verify strict data minimization and telemetry validation.

This module is a thin execution wrapper that conditionally runs an internal scripts/track.mjs using spawnSync. The main security concern is that the executed script’s path is influenced by CLAUDE_PLUGIN_ROOT and the child’s output is suppressed, reducing visibility. The wrapper itself shows no direct malicious actions, but it creates a high-impact delegation point: if the environment variable or filesystem contents can be manipulated, an attacker could redirect execution to an unintended track.mjs with inherited environment context. Review scripts/track.mjs and the trust boundaries around CLAUDE_PLUGIN_ROOT.

SUSPICIOUS: the stated GitHub automation purpose is coherent, and official `gh` usage is benign, but the skill unnecessarily routes core actions through unpinned third-party `npx claude-flow` commands with unclear publisher continuity and unspecified data flows. This is mainly a supply-chain and credential-adjacent trust issue rather than confirmed malware.

No explicit malware is visible in this JSON configuration. However, it creates a significant supply-chain execution risk by launching an npm-distributed CLI via npx using a floating 'latest' reference and non-interactive '-y' behavior. The executed code can change over time without this config updating, and the spawned process will communicate with the MCP host over stdio. Pin an exact version (and ideally verify integrity/provenance) to reduce risk.