orchestrate

SUSPICIOUS. The stated purpose matches multi-agent orchestration, tmux control, GitHub checks, and state-file management, so core capabilities are broadly aligned. The main risks are autonomy and oversight reduction: bypass-permissions launches, self-sustaining polling, and instructions to approve some work without surfacing it to the user. Optional Discord webhook notifications add external data flow, and the referenced local scripts were not provided, leaving important behavior unverifiable. Not confirmed malware, but materially risky as an automation skill.

This supervisor loop restarts Claude sessions and automatically confirms certain dialogs and command prompts. It launches Claude with --permission-mode bypassPermissions and interpolates agent metadata into shell commands without visible escaping, creating meaningful automation and injection risks if that metadata is untrusted. No direct data theft, suspicious network destination, or destructive payload is evident in the shown fragment. Severity is moderate to high for environments where agent state or pane content can be influenced by untrusted parties.

This script orchestrates a Claude coding agent in a Git worktree and records its task state. The main security concern is shell injection through an unescaped WORKTREE_PATH, alongside launching Claude with `bypassPermissions` and automatically answering a detected confirmation prompt. No direct credential theft, exfiltration, or other malware behavior is evident; severity is moderate and depends on whether the path, task, and repository contents are trusted.