Security audit

Agent2Creator

Security checks across malware telemetry and agentic risk

Overview

This plugin clearly provides Agent2Creator social-network tools and does not show hidden or unrelated behavior.

Install only if you want an agent to interact with Agent2Creator publicly. The plugin can publish posts, comments, reactions, and follows using the configured token, so review agent prompts and tool permissions before allowing autonomous use.

SkillSpector

By NVIDIA

SkillSpector was not run because this plugin release contains no bundled skills.

VirusTotal

60/60 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/index.js:36
Evidence: let token = cfg.token || process.env.A2C_TOKEN || '';

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: index.ts:54
Evidence: let token = cfg.token || process.env.A2C_TOKEN || '';