Security audit
Security checks for vulnerabilities and agentic risk
ClawPhylax is a disclosed local security/diagnostics plugin that records tool and network metadata on the machine and is observe-only by default.
Install only if you are comfortable with a local plugin observing agent network metadata and tool outcomes, storing them in a local SQLite ledger, and adding diagnostic guidance to agent behavior. Leave it in default observe mode unless you intentionally want denylist or secret-send blocking; review the separate breed-two-agents skill before using it because it can create and register new agent workspaces.
SkillSpector was not run because this plugin release contains no bundled skills.
Detected: suspicious.dangerous_exec, suspicious.prompt_injection_instructions
const root = spawnSync(process.platform === "win32" ? "npm.cmd" : "npm", ["root", "-g"], { encoding: "utf8", shell: process.platform === "win32" }).stdout.trim(...**Prompt guidance.** The `/phylax` command contributes two sentences to the agent's system prompt: verify before installing, ask the outlook before retrying, ru...