content-gen

The code is intended as a local course scaffolder, not malware. However, if the syntax issues are corrected, a crafted manifest order value may enable writes outside the requested output directory because generated paths are not containment-checked. Validate order values and resolve/check every target path before writing.

This is a CI validation utility, not apparent malware. Its smoke-command allowlist is insufficient when course manifests may be untrusted: shell syntax can permit unintended commands to execute under --run-smoke. Restrict commands to parsed argument arrays or reject shell operators and substitutions; only run smoke tests on trusted manifests.

This is a dependency-based code-verification harness, not evidently malware. Its intended workflow has a material trust-boundary risk: untrusted Markdown can influence npm and Cargo dependencies, including arbitrary Git sources, and those dependencies may execute code during installation or compilation. Use only with trusted course content or in an isolated environment.

No independent malware behavior such as credential theft, suspicious network communication, or destructive actions appears in this verifier. Its intended operation executes challenge-controlled code and raw test expressions with the current user's privileges, so it should only process trusted course content or run inside an appropriately isolated environment. Manifest paths also lack containment checks.