mcp-dynamic-orchestrator

SUSPICIOUS. The skill’s purpose is coherent, but its footprint is broader than a simple MCP discovery helper: it dynamically executes agent code, spawns external package-manager tools, and may route service interactions through third-party CLIs like mcp-remote. The Cloudflare example uses an officially documented endpoint, which lowers maliciousness, but the unpinned remote-exec model and credential/data forwarding through non-Cloudflare code make this a high security-risk orchestration skill rather than a benign low-risk guide.

The code implements dynamic JavaScript execution via Node’s `vm` with `vm.createContext` as the isolation mechanism, but the text explicitly states that this boundary is not secure and provides escape-capable scenarios. As a result, if an attacker can influence `code` (including via a compromised/hostile upstream server), the executed code may escape and gain access to Node capabilities (e.g., filesystem/process control), plus there is a risk of resource exhaustion due to insufficient CPU/memory enforcement. Mitigations (disabled-by-default, documentation, and allowlisting/policy for tool selection) reduce accidental misuse but do not address the fundamental “untrusted code execution with an escapeable boundary” risk. Prefer strong isolation (separate process/worker with hard OS-level controls or an actual isolate/WASM capability model) before allowing any untrusted inputs.