newapi

SUSPICIOUS. The stated purpose broadly matches the capabilities, and the scanner findings are not real command injection. The main concern is that sensitive token handling is forced through local helper scripts not provided for review, including command execution and config mutation with secrets; this is proportionate but only partially verifiable, so the skill carries medium security risk rather than clear malicious intent.

This is an API command-line client with a legitimate token-masking feature. It does not show clear malware or intentional sabotage. However, it forwards ACCESS_TOKEN and USER_ID to any destination formed from BASE_URL and urlPath, and its masking is incomplete because non-200 token responses and token fields with names other than exactly "key" are printed unmasked. The risk depends on how BASE_URL and the command arguments are controlled.

The code appears to be a deliberate token-injection command-line utility rather than hidden malware. Its primary security risk is intentional arbitrary shell execution combined with embedding a fetched secret into the command string. Callers able to control the command can execute arbitrary commands, and the token can leak through process arguments or shell behavior. The risk is significant if command input is attacker-controlled; use argument-array execution without a shell and pass secrets through safer mechanisms where possible.

No direct malware is evident in the provided documentation. The design presents a security-sensitive secret-handling and shell-execution interface; its safety depends on strict command construction, placeholder validation, shell escaping, token authorization, and comprehensive redaction in the omitted implementation. Review the actual `exec-token.js` source before deployment.