mission-control

This module is an orchestration component that intentionally spawns Node.js processes to run 'skill' scripts described by a MissionContract. The code itself does not contain obfuscated or clearly malicious payloads, but it enables execution of arbitrary code found under process.cwd()/<skill> by using contract-controlled fields. If untrusted actors can supply or modify the contract, the global index, or the skill directories, they can execute arbitrary commands, access environment variables, and read/write files — a significant supply-chain / privilege escalation risk. Mitigations: validate and whitelist permitted skills, sign/verify skill packages or the index, sanitize skill names/paths, drop sensitive env vars before spawn, and run skills in a sandboxed environment (containers, restricted users, seccomp), or implement capability constraints. Use this module only in trusted contexts or add the recommended protections.