okf-mcp

SUSPICIOUS: the skill's behavior matches its purpose, and the install source is same-repo and plausibly legitimate, but it auto-discovers and executes arbitrary okf-* binaries from PATH and forwards secrets to them. The main risk is transitive trust and credential forwarding to separately installed connector binaries, not confirmed malware.

No explicit malicious payload or obfuscation is evident in this fragment. However, it implements a high-impact runtime discovery-and-execution mechanism: it scans PATH/OKF_SKILLS_DIR/--skills-dir for okf-* binaries, registers their schemas as MCP tools, and later executes the selected binaries while forwarding the full server environment and relaying tool output over MCP stdio. If an attacker can influence discovered binaries or their locations, this can enable arbitrary code execution and potential secret exfiltration via inherited environment variables and tool stderr/stdout. Overall, treat this component as a substantial supply-chain risk and ensure discover/load/register enforce strong trust boundaries (allowlists/signatures, strict schema/argv validation, and environment/secret minimization) beyond what is visible here.

This module is largely a router that registers MCP tools and forwards untrusted JSON inputs into an execution pathway (buildInvocation -> run) with derived argv and extra environment. The fragment itself shows no malicious indicators (no network calls, credential theft, or obfuscated logic), but it creates a significant command/execution attack surface because it does not validate JSON fields beyond parsing and relies entirely on the unseen buildInvocation and Runner/run implementations to safely construct argv/env and to avoid unsafe execution semantics. Error text is also propagated back to the caller, which may increase information disclosure risk depending on upstream error contents.