botchan-net

SUSPICIOUS. The skill is internally coherent for an on-chain social/trading agent, and the install sources appear purpose-aligned, but its footprint is broad: it enables autonomous public communication, financial/token actions, agent execution, and transitive installation of another skill. Risk is driven more by powerful real-world actions and mutable remote dependencies than by clear evidence of malware or covert exfiltration.

The code appears intended for relay-session creation, but it transmits a raw secret key to a caller-selected endpoint. This creates a significant credential disclosure risk if the endpoint is untrusted or not protected by HTTPS. The behavior may be part of the relay protocol, but endpoint trust and transport security should be verified.

The code contains a hardcoded private key that is used as a Seaport signer. This is a serious secret-management risk and may expose the associated account if the key is real and has assets or permissions. The fragment does not show direct exfiltration or establish malicious intent; the key's validity and intended use cannot be determined from this file alone.

No clear malware or data theft is present in the workflow. The main security concern is executing pull-request-controlled code in the screenshot-preview job while granting repository and pull-request write permissions and retaining checkout credentials. A compromised or malicious PR could potentially use these privileges to modify repository branches or comments. The practical exposure depends on GitHub fork-token settings and repository policy; use a read-only, unprivileged test job and isolate any privileged publishing step.

No evidence of malware or unauthorized external activity. The code has a denial-of-service risk if chunkSize is zero or negative, and XML injection risk when untrusted values are passed to the metadata-generation functions.

The code appears to implement relay session creation, not overt malware. However, it transmits the raw secret key to a caller-selected API endpoint and does not enforce HTTPS or validate the destination. Use only a trusted endpoint over HTTPS, and assess whether sending the raw secret is necessary for the protocol.

This package performs an install-time action (node ./scripts/postinstall.mjs) and depends on several local file: dependencies and external prepack/postpublish scripts. The immediate risks are: the postinstall script can run arbitrary code at install time (high-risk until reviewed); file: dependencies are non-registry sources (at least medium risk per rules); and external relative scripts for prepack/postpublish increase supply-chain exposure. Recommend reviewing scripts/postinstall.mjs, the referenced ../../scripts/*.sh files, and the source of the file: dependencies before installing in a sensitive environment. If this package is published from a monorepo you control, these patterns are common, but they still require code review.