modal-deploy

SUSPICIOUS: the skill’s Modal deployment behavior is mostly aligned with its stated purpose, but the install footprint is riskier than necessary. The main concerns are transitive skill installation from a personal GitHub repo, bypass guidance via direct git clone into agent skill directories, and mutable download/execute patterns without strong release verification. Runtime data flows are largely coherent with Modal deployment and do not show clear credential theft.

This module is highly security-sensitive: it spawns `/bin/bash` inside a PTY and bridges its full interactive I/O over an unauthenticated WebSocket (`/ws`). Client-supplied bytes are written directly to the shell, and raw shell output is streamed back to the client, enabling remote command execution and data disclosure. Additionally, copying the entire server environment into the shell increases the impact if the endpoint is reachable by untrusted users. If this service is exposed beyond a trusted boundary, it should be treated as an extreme security risk.

No explicit malicious behavior (e.g., exfiltration, backdoor, credential harvesting) is visible in the installer script itself; however, it has significant supply-chain risk. It downloads and extracts unverified upstream code from the moving `main` branch (no checksum/signature/pinning) and copies that content into multiple agent skill directories where it can later run. Additionally, it may execute installation logic via `npx skills add`, which is an execution-capable dependency installation pathway. Treat this as a supply-chain-sensitive installer and require pinning/verification of the upstream revision and inspecting what the installed skill does.