loki-mode

SUSPICIOUS: the skill’s main risk is not obvious malware but disproportionate autonomy. Its stated purpose matches project orchestration, yet the default requirement to disable permission prompts and the insistence on zero-human-intervention make it high risk for unintended real-world actions. Supply-chain risk is moderate from unpinned npx usage, but install provenance appears official rather than deceptive.

No explicit malware payload (e.g., crypto-mining, reverse shell, hardcoded exfil endpoints) is present in the bash fragment itself. However, the script is a high-risk autonomous supply-chain runner: it uses `claude --dangerously-skip-permissions` and is designed to iteratively execute tool actions and modify the codebase with broad SDLC phases, potentially persisting learnings in the user’s home directory. Security controls like blocked commands/staged autonomy appear either optional or not clearly enforced in this fragment. Treat this package as potentially dangerous in automated pipelines and require strict isolation/auditing of tool execution.

This code is highly unsafe because it builds a Python expression string from caller-controlled `operator` and `operand` values and passes it directly to `eval()`. Without strict allowlisting of operators and strict numeric validation of operands, it enables arbitrary code execution (RCE) in the Python process. Treat as critical security risk and avoid using in any context where inputs can be influenced by an attacker.