vibe-coder

This is a project-validation utility, not apparent malware. However, shell interpolation of the project path and template-derived endpoint values creates command-injection risks, and the script executes the target project's build/runtime code and force-kills processes on the selected port. Use only with trusted projects or isolate it and replace shell command strings with argument lists.

SUSPICIOUS. The skill's core function—automatic debugging and code fixing—fits a development workflow, and there is no meaningful supply-chain or credential-exfiltration behavior in the provided text. However, the explicit instruction to hide actions and technical failures from the user is a real concern: it enables autonomous code changes without transparent disclosure, making the skill's behavior less trustworthy even if not clearly malicious.

SUSPICIOUS. The core verification purpose is plausible and proportionate, but the skill is intentionally concealed from the user and instructs silent autonomous remediation before reporting success. There is no clear credential theft or exfiltration path in the provided material, so this is not confirmed malware; the main risk is covert autonomous behavior and hidden decision-making.

The stated purpose is plausible and the footprint shown is narrow: a local security scan and code auto-fixes with no visible credential use, downloads, or external data routing. The main issue is the explicit directive to operate silently and hide actions from the user, which makes the skill suspicious despite otherwise limited scope.