claude-channels

SUSPICIOUS: The skill’s capabilities mostly match its stated purpose, but it materially increases risk by enabling remote-triggered autonomous agent operation, including an explicit path to bypass approval prompts. Install trust is mixed: Bun’s installer is official but pipe-to-shell, and the plugin marketplace includes external plugins that may receive bot tokens. The biggest concern is not clear malware behavior, but the combination of untrusted remote inputs plus optional no-approval execution.