Security audit

AgentHub Manager

Security checks for vulnerabilities and agentic risk

Overview

The plugin mostly matches its AgentHub-management purpose, but it installs Python code automatically and grants broad local command/file control with weak scoping, so it should be reviewed before installation.

Install only if you are comfortable with an npm package modifying your Python environment, installing code from bundled wheels or GitHub, and letting the agent start/stop local services and edit files. Prefer running it in a virtual environment or disposable workspace, inspect the AgentHub configs before starting agents, and avoid exposing untrusted prompts to the file-path or start/stop tools.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/http.js:56
Evidence: const out = execSync(grep, { encoding: "utf-8" }).trim();

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/index.js:71
Evidence: execSync(cmd, { stdio: "ignore" });

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/check-python.js:23
Evidence: return execSync(cmd, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();