bad

SUSPICIOUS: the skill’s core purpose matches repo automation, but its footprint is overpowered for an AI skill because it removes user approval, performs real-world GitHub actions, persists via timers/monitors, and can auto-merge code. No confirmed credential theft or malware is shown, but the missing setup instructions prevent verification of the module’s installation trust.

The code is a local activity-log hook installer, not clearly malware. Its intended behavior captures Claude tool activity and writes it to local files. The main security concerns are privacy exposure from logging command and tool-input data, unsanitized session_id path components, and unsafe interpolation of filesystem paths into generated shell and jq code. These issues warrant remediation in a security-sensitive environment, but there is no evidence of network exfiltration or deliberate destructive behavior in the provided fragment.

This is an automation prompt with significant operational and change-management risk, not evident malware. It authorizes destructive local and remote Git operations and automatic GitHub issue creation without confirmation. It should not be executed in unrestricted or auto-approved mode; require explicit authorization, validate paths and commands, preserve uncommitted changes, and review generated issue content and branch deletions.

The procedure has a credible legitimate purpose, but it introduces a significant command-injection risk by inserting an existing configuration value directly into generated shell source without quoting or validation. It also persists potentially sensitive Claude session data in the project directory. No definite malware or deliberate exfiltration is demonstrated in the supplied documentation, but the referenced script must be reviewed before use and CHAIN_COMMAND should be executed safely as an argument or validated rather than interpolated into shell code.

The fragment is procedural CI-agent guidance rather than malware. It contains a significant supply-chain and automation security risk because it instructs execution of arbitrary pull-request workflow commands and permits automated fixes followed by commit and push without trust boundaries or sandboxing. The text itself does not show credential theft or other malicious payloads.

This is a repository maintenance procedure with significant operational risk due to unconditional destructive Git commands and forced worktree removal. It does not provide evidence of malware or supply-chain compromise, but it should not be auto-approved without confirming that local changes and worktrees may be discarded. No code was supplied beyond shell-oriented instructions.