remake

highEngine code is fetched and updated live from GitHub, then installed globally

The skill does not run the reviewed bundle. It clones the author's repo, runs `git pull` on every use, runs `npm install`, and installs the package globally on the PATH. The author can change the executed code at any time after this review, and that code then runs with the user's gh and Vercel sessions. This is the most likely path for unreviewed code to run, though the current code shows no malicious behavior.

plugins/remake/skills/remake/SKILL.md:15 [ -d ~/.remake ] || gh repo clone rubenhassid1/remake ~/.remake -- --depth 1 || git clone --depth 1 https://github.com/rubenhassid1/remake ~/.remake

plugins/remake/skills/remake/SKILL.md:16 git -C ~/.remake pull --ff-only --quiet; npm --prefix ~/.remake install --silent

plugins/remake/skills/remake/SKILL.md:17 npm install -g ~/.remake --silent # puts a `remake` command on the PATH

mediumEngine is fetched from GitHub and auto-updated on every setup, then installed globally

The skill tells the agent to clone the author's repo into ~/.remake, pull new commits each time setup runs, run npm install, and install it globally. The code that actually runs is whatever is on the default branch at that moment, not the reviewed bundle. A later commit could change behavior without another review.

plugins/remake/skills/remake/SKILL.md:15 [ -d ~/.remake ] || gh repo clone rubenhassid1/remake ~/.remake -- --depth 1 || git clone --depth 1 https://github.com/rubenhassid1/remake ~/.remake

plugins/remake/skills/remake/SKILL.md:16 git -C ~/.remake pull --ff-only --quiet; npm --prefix ~/.remake install --silent

plugins/remake/skills/remake/SKILL.md:17 npm install -g ~/.remake --silent # puts a `remake` command on the PATH

mediumDoctor installs system software (GitHub CLI via brew, Vercel CLI globally, Chromium)

`remake doctor --fix` installs Homebrew and global npm packages and downloads about 150 MB of Chromium. The setup step runs it without asking the user. This is expected for the tool's purpose, but users should know it changes their system.

engine/lib/doctor.mjs:23 spawnSync("brew", ["install", "gh"], { stdio: "inherit" });

engine/lib/doctor.mjs:33 spawnSync("npm", ["install", "-g", "vercel"], { stdio: "inherit" });

plugins/remake/skills/remake/SKILL.md:18 remake doctor --fix

mediumAgent told to start account sign-ins and to deploy without asking again

The skill has the agent launch GitHub and Vercel OAuth logins on its own. It also treats the initial request as standing permission to create repos and production deploys on the user's accounts. Each deploy is scoped to a private repo and a passcode-gated site, but these are account-level actions taken without a confirmation step.

plugins/remake/skills/remake/SKILL.md:23 `doctor --fix` installs Chromium for Playwright and the Vercel CLI. If GitHub or Vercel isn't signed in, run `gh auth login --web` or `vercel login` yourself an

plugins/remake/skills/remake/SKILL.md:45 6. **Ship.** `remake ship`. Private GitHub repo, Vercel deploy, passcode in the `REMAKE_PASSCODE` variable, gate checked from outside. The user's request to put

mediumAutomatically drives the user's Codex/ChatGPT plan as a sub-agent with write access

If a codex binary and ~/.codex/auth.json exist, `remake images --make` runs `codex exec` in parallel batches with a workspace-write sandbox. This spends the user's ChatGPT plan usage and runs a second AI agent on the machine. The user is told about this only in passing; no explicit consent is requested. The working directory is limited to a cache folder.

engine/lib/images.mjs:207 if (codex && fs.existsSync(path.join(os.homedir(), ".codex", "auth.json"))) list.push({ name: "codex", bin: codex });

engine/lib/images.mjs:225 const args = ["exec", ...(model ? ["-m", model] : []), "--skip-git-repo-check", "--sandbox", "workspace-write", "-C", dir, prompt];

mediumCopies third-party sites wholesale, including published source-map originals, and redeploys them

The tool copies another party's HTML, scripts, fonts, images and original source files, then deploys the copy to Vercel. It mitigates this with a passcode gate, noindex headers, a private repo, a swap board, and refusal of login and checkout pages. Copyright and trademark exposure still rests with the user, and paid fonts and photos remain until they are swapped.

engine/lib/capture.mjs:501 // Source maps: the site's original source files, when it publishes them.

README.md:41 | **Their source** | When a site publishes source maps, the original source files land in `remake/sources/`. |

engine/lib/capture.mjs:583 out = out.replace(/\s+integrity\s*=\s*(["'])[^"']*\1/gi, "");

mediumInstalls global tools and leaves a global command after the plugin is removed

`doctor --fix` installs the Vercel CLI globally and may install gh through Homebrew. The skill also puts a global `remake` binary on PATH. None of this is removed when the plugin is uninstalled.

engine/lib/doctor.mjs:33 spawnSync("npm", ["install", "-g", "vercel"], { stdio: "inherit" });

engine/lib/doctor.mjs:23 spawnSync("brew", ["install", "gh"], { stdio: "inherit" });

mediumPublishes to GitHub and Vercel without asking, and may rewrite the git author and force-push

The skill tells the agent not to ask before creating repos and deploying. `ship` runs `gh repo create`, sets Vercel env vars and deploys. If Vercel rejects the commit author, it changes the project's git email to the Vercel account email, amends the commit and force-pushes. These changes are local to the project and expected for the purpose, but the user should know they happen without confirmation.

plugins/remake/skills/remake/SKILL.md:45 6. **Ship.** `remake ship`. Private GitHub repo, Vercel deploy, passcode in the `REMAKE_PASSCODE` variable, gate checked from outside. The user's request to put

engine/lib/ship.mjs:147 sh("git", ["config", "user.email", user.email], { cwd: root });

engine/lib/ship.mjs:149 sh("git", ["push", "--force-with-lease", "-u", "origin", "HEAD"], { cwd: root });