doc-arch-rules

SUSPICIOUS. The skill is not overt malware and its broad file-writing behavior is mostly consistent with being a meta generator, but it creates and updates multiple downstream operational skills with command-running/install capabilities, creating a meaningful transitive trust and supply-chain risk surface. No clear credential theft, covert exfiltration, or malicious pre-execution behavior is present.

The fragment appears to be a legitimate database command-line administration/query tool rather than malware. It does not exfiltrate credentials or system data and uses parameterized SQL for project lookup and cleanup. Security concerns are operational: --cleanup can permanently delete project data, and the prefix-based read-only check does not robustly prove that WITH statements are non-mutating. The tool should use a least-privileged read-only database account for query mode, explicitly reject multi-statements and all modifying forms, and protect cleanup with stronger authorization or a separate command.

The code appears to be a legitimate OpenAPI splitting utility, not malware. It has a moderate filesystem safety issue because attacker-controlled domain values can influence output filenames without sanitization, potentially causing path traversal or overwriting files outside the intended output directory. Validate domain names against a safe filename pattern and resolve/check the final paths beneath the output directory. The apparent missing closing parenthesis would cause a syntax error if present in the exact source.

未发现明确恶意代码或供应链后门。该文件存在较明确的命令注入和危险路径操作风险：多个不可信或未验证参数被拼接进远程 shell 命令，尤其是 service、迁移命令、健康 URL、审计字段及路径参数。若这些值仅来自受信任的部署配置，实际风险较低；若可被外部输入或低权限发布者控制，则可能在目标机执行任意命令或删除任意目录。应改用严格白名单校验、可靠的 shell 参数转义，并限制 prune 的路径和文件名格式。

This is a conventional backend release script with expected remote deployment, dependency installation, migration, cleanup, rollback, and health-check behavior. It does not show clear malware indicators. However, direct interpolation of configuration values into remote shell commands creates a significant command-injection risk when those values are attacker-controlled, and fixed /tmp files plus suppressed dependency errors weaken deployment integrity. The unprovided release-common.sh must also be reviewed before considering the complete deployment mechanism safe.

The fragment is a normal Docker Compose deployment template and shows no direct evidence of malware or intentional data theft. It has several operational and supply-chain security risks: an insecure JWT secret fallback, mutable image tags, environment-name inconsistency, unresolved template placeholders, externally published backend access, and a writable host release mount. These issues should be corrected before production use, but they do not by themselves indicate malicious code.