Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.
Static reason
No blocking static signals were detected.
Trigger
User runs guanwf install-skill.
Impact
Can modify configured AI-assistant skill directories and make package-aligned workflow API/telemetry requests when invoked.
Mechanism
Explicit AI-assistant skill installation and native workflow CLI execution.
AI rationale
This is an explicit-user AI-agent configuration capability, not an unconsented lifecycle hijack. The opaque native binaries and shell-enabled npx invocation leave real but non-blocking risk.
Evidence
package.jsonbin/run.jsskills/guanwf/SKILL.mdbinaries/guanwf-linux-x64skills/guanwf/~/.codebuddy/skills/guanwf~/.workbuddy/skills/guanwfbinaries/guanwf-*
Network endpoints1
www.google-analytics.com/mp/collect