autonomous-dispatcher

SUSPICIOUS. The skill is internally coherent for a GitHub issue dispatcher, and its main data flows go to official GitHub/AWS services, so it is not confirmed malicious. Risk is elevated because it autonomously acts on untrusted issue content, mints GitHub App tokens, and can trigger remote AWS SSM execution, giving it a broader footprint than a simple read-only coordinator.

The fragment is legitimate dispatcher orchestration code and shows no clear malware behavior. However, its inline-block validator is incomplete: it validates only a prefix and a blacklist, while eval interprets the complete line as Bash. An attacker or accidental configuration author able to modify dispatcher.conf could potentially achieve unintended command execution or file redirection. The trust-gate assumption reduces exposure but does not make eval safe. The code should parse assignments without eval or use a strict full-line grammar and explicitly reject whitespace after the value and all shell operators.

No clear malware or supply-chain backdoor is present. The main security issue is deliberate execution of AGENT_REVIEW_LAUNCHER_<AGENT> through eval; this permits arbitrary command execution when that environment value is attacker-controlled or insufficiently trusted. The implementation otherwise performs environment-based precedence resolution and model labeling consistent with its documented purpose.

The fragment appears to be a remote SSM log-management utility with deliberate validation and error handling. No clear malicious payload, credential theft, exfiltration, persistence, or obfuscation is present. Security review should verify that SSM_REMOTE_PROJECT_ID and ISSUE_NUM are strictly validated before heredoc interpolation; otherwise they may enable remote shell command injection. Sourcing an arbitrary absolute profile is also high-impact but appears intentional.

The fragment appears to implement legitimate opencode session management and does not show clear malware. However, it contains a potentially exploitable shell-command injection and path-manipulation weakness because dispatcher session_id is interpolated into an awk system() command and sidecar path without validation or escaping. Strict validation of session_id, use of safe file APIs, and removal of shell execution from awk are recommended. Model argument quoting should also be corrected.