vibe-delegate

SUSPICIOUS: the core purpose is coherent, and the main CLI/auth flow appears official and proportionate, so this is not confirmed malware. The main concerns are transitive trust in a community-published wrapper, missing bundled runtime, and the option to grant a delegated agent arbitrary shell access under --full-access.