agent-fleet

SUSPICIOUS. The core capability is coherent for a multi-model task runner, and the docs openly describe risks and mitigations, so this is not confirmed malware. However it still launches a bypassPermissions autonomous agent with file and shell access, forwards prompts and credentials to external endpoints, includes a bundled third-party gateway on a test-domain path, and permits arbitrary custom gateways for Gemini-compatible routing. Those data-flow and trust-expansion choices are proportionately risky for a local orchestration skill.

SUSPICIOUS. The skill’s stated purpose matches its core capability—delegating cheap bulk tasks to other models—but its footprint is high-risk: a bypassPermissions autonomous agent can read/write files and run bash, and optional routing through a third-party gateway expands the data boundary. This is not confirmed malware, and the document is unusually candid about risks and mitigations, but the combination of autonomous tool use, untrusted-directory processing, and third-party model/gateway data flows makes it a high-security-risk skill.

The fragment is readable orchestration code for running Claude Agent SDK tasks. It does not itself show malware or direct data theft. The main security risk is intentional permission bypass, which gives the agent broad authority in cwd and should only be used with strong isolation and trusted settings. The supplied code alone is insufficient to assess the imported helper modules or the exact capabilities enabled by the SDK.