auto-loop

This dispatcher is mostly orchestration/state management, but it contains a significant supply-chain scripting risk: it executes dynamically generated Bash via eval on the output of parse-goal-spec.sh, which is derived from a user-specified goal-file. If parse-goal-spec.sh is imperfect or the goal spec can influence its output beyond safe variable assignments, this can enable arbitrary command execution in the caller’s context. Aside from that, the module shows no clear indicators of malware (no networking/exfiltration/credential theft), but downstream helper scripts and the stop-hook installation path are critical to assess for real malicious behavior.