Security audit

Frontend Craft

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate frontend workflow plugin with disclosed project-editing, formatting, template, and design-integration features that should be used with clear scope.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.obfuscated_code

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: skills/fec-drawio-studio/scripts/drawio-export.mjs:133
Evidence: const result = spawnSync(plan.command[0], plan.command.slice(1), { stdio: "inherit" });

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: skills/fec-image-generation/scripts/diagram-browser.mjs:18
Evidence: if (path.isAbsolute(candidate) ? fs.existsSync(candidate) : spawnSync(candidate, ["--version"], { timeout: 5000, windowsHide: true, stdio: "ignore" }).status ==...

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: skills/fec-image-generation/scripts/export-diagram.mjs:195
Evidence: const result = spawnSync(command, [pngPath, "-background", "white", "-alpha", "remove", "-quality", "95", outputPath], {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: skills/fec-image-generation/scripts/mermaid-render.mjs:39
Evidence: const version = spawnSync(command, [...prefix, "--version"], { encoding: "utf8", timeout, windowsHide: true });

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: dist/index.js:152
Evidence: `){let Ii="Implicit keys of flow sequence pairs need to be on a single line";Ne.errors.push(new t.YAMLSemanticError(ur,Ii));break}}}else Xe=null;Mt=null,$e=!1,U...