Security audit

cloro

Security checks across malware telemetry and agentic risk

Overview

This is a coherent cloro API plugin for AI and Google monitoring; the main considerations are API key use, sending prompts or searches to cloro, and credit costs.

Install only if you are comfortable giving this community plugin a cloro API key and sending monitored prompts or search queries to cloro. Review cloro pricing and avoid broad multi-provider requests unless needed, because tool calls consume credits.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

VirusTotal

64/64 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/index.js:7
Evidence: const apiKey = cfg.apiKey ?? process.env.CLORO_API_KEY;

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: index.ts:20
Evidence: const apiKey = cfg.apiKey ?? process.env.CLORO_API_KEY;