loop-coding

SUSPICIOUS: the skill’s purpose broadly matches large-scale coding orchestration, but its footprint is expansive. The main risks are third-party skill rental from skills.sh, transitive trust in downloaded skill content, autonomous push/staging actions, and outbound Telegram artifact delivery; these are proportionally risky even if some external tools are official.

This module is not indicative of hidden malware/backdoors; it is a straightforward escalation/notification script. However, it is a clear and high-impact data-sharing mechanism: it uploads local REVIEW.md/FIX-LOG.md contents to Telegram using a bot token read from disk, with chat destination driven by an environment variable. The main security concern is sensitive information exfiltration (privacy/IP/secrets) if the artifacts contain confidential data or if PRINCE_CHAT_ID/RUN_DIR are misconfigured or controlled unexpectedly.