ucoz-provisioning-skill

No direct malicious behavior is present in this configuration fragment. The primary supply-chain risk is automatic execution of the mutable ucoz-mcp@latest package with access to API and FTP credentials. Pinning an audited version or lockfile, verifying package provenance, and using least-privilege or scoped credentials would reduce risk.

The fragment appears to be legitimate uCoz provisioning automation rather than malware. It intentionally handles account, panel, API, FTP, and secret-answer credentials and performs privileged account changes. The principal security issue is insufficient host validation for BASE_URL and DOMAIN, allowing a malicious configuration to redirect browser navigation and potentially submit credentials to an attacker-controlled site. OUTPUT_SECRETS=true can also disclose API credentials to logs and the output file. Use only trusted configuration, restrict BASE_URL and DOMAIN to expected uCoz hosts, and keep secret output disabled.

The script is a launcher rather than direct malware. Its primary security concern is high-risk supply-chain execution: it automatically downloads and runs the mutable latest version of an npm package while exposing API and FTP credentials in the environment. Pin a reviewed package version or lockfile, verify package provenance, and avoid providing secrets unless required. No direct credential theft, exfiltration, persistence, or destructive behavior is present in the supplied fragment.

No direct malicious behavior is present in the supplied configuration. It does create a meaningful supply-chain and credential-exposure risk by automatically executing the mutable `ucoz-mcp@latest` package with API and FTP credentials. Pin a reviewed version, preferably enforce integrity verification, and provide least-privilege or scoped credentials.