engineering-advanced-skills

This code fragment functions as an abuse-enabling “stealth/evasion toolkit” for Playwright automation: it injects scripts to remove automation indicators, spoofs multiple high-signal browser fingerprint surfaces (navigator properties, WebGL vendor/renderer, canvas pixel output), and simulates human-like interaction timing, with optional proxy routing. While there is no clear evidence of credential theft, persistence, or exfiltration in the provided snippet, its explicit anti-detection design materially increases the likelihood of bypassing access controls and performing potentially unauthorized scraping. Treat as high misuse risk rather than confirmed self-contained malware.

No strong indicators of intentional malware (no C2/exfiltration, no keylogging, no reverse shell, no cryptomining). However, there are meaningful security risks typical for tooling: (1) user-controlled outputFile can lead to arbitrary file writes/deletes via fs.writeFileSync/rename/unlink; (2) the tool generates and executes a Python stitching script using execSync with a path derived from outputFile; (3) it executes JavaScript inside the browser via CDP Runtime.evaluate and can navigate to attacker-supplied URLs, potentially enabling host-internal network access. If the package is used with untrusted CLI arguments or against untrusted proxy endpoints, review/limit filesystem and command execution.

No clear evidence of stealthy malware (exfiltration/persistence) is visible in the fragment. However, the code contains a significant and concrete security risk: it executes a user-provided evaluation command with `subprocess.run(..., shell=True)` directly from the CLI argument --eval, enabling arbitrary command execution. Optional evaluator copying and branch creation further expand supply-chain/code-introduction risk, but their safety cannot be confirmed from this snippet.

This module itself is not visibly malicious or obfuscated, but it contains a high-impact security design flaw: it executes a user/config-provided eval_cmd via subprocess.run(..., shell=True) with cwd set to a git worktree path. If an attacker can influence --eval-cmd or the per-session config.yaml content, this becomes a straightforward arbitrary command execution vector. Additionally, config.yaml is read from a path constructed using an unvalidated session_id, which can pose an unintended file read/path traversal risk depending on caller constraints.

No direct evidence of embedded malware (e.g., exfiltration, backdoors, persistence) or intentional obfuscation is present in this module’s logic. However, it has a critical supply-chain/sandbox-break risk: it executes a shell-interpreted command (shell=True) taken directly from experiment_dir/config.cfg (evaluate_cmd). If config.cfg (or experiment_dir contents) can be influenced by an attacker, this becomes arbitrary command execution in the project directory. The script also performs destructive git resets on failure/timeout, increasing operational impact. Recommend strict validation/whitelisting of evaluate_cmd, avoiding shell=True (use argv lists), and running evaluations in a heavily restricted environment (e.g., container/sandbox) with immutable configs.

SUSPICIOUS: the skill’s core behavior is mostly consistent with its stated purpose, but it gives an AI coordinator broad autonomous control over spawning agents, executing eval commands, reading untrusted agent outputs, and merging code. The main concern is operational risk and prompt-injection exposure rather than confirmed malware; install trust is only mildly concerning due to the ClawHub syntax mismatch, not hostile provenance.

SUSPICIOUS: the index skill is coherent as a catalog of engineering sub-skills, but its trust model is broader than it first appears. The main concern is supply-chain and transitive installation risk: a third-party npm CLI is used to install/load additional skills, and the wider repo documents mutable script-based installers. No direct credential harvesting, exfiltration, or malicious behavior is evident in this top-level file alone.