Security audit
Security checks across malware telemetry and agentic risk
Sage appears to be a real security plugin, but it needs Review because it broadly monitors agent actions, sends some security telemetry to cloud services, and includes source comments describing scanner-avoidance patterns.
Install only if you are comfortable with a security plugin inspecting agent commands, URLs, file paths, write/edit content, and installed plugins; storing local logs and exceptions under ~/.sage; and sending URL/hash/verdict telemetry to Sage/Avast-backed services. Review configuration for community_iq, url_check, file_check, package_check, logging, amsi_check, and pi_check before use.
## Remote Code Execution - **Never pipe untrusted content to a shell** (`curl | bash`, `wget | sh`). Always download first, inspect, then execute. - Avoid `eval()` on untrusted input in any language. - Be cautious with `source` or `.` commands on remote scripts.
## Remote Code Execution - **Never pipe untrusted content to a shell** (`curl | bash`, `wget | sh`). Always download first, inspect, then execute. - Avoid `eval()` on untrusted input in any language. - Be cautious with `source` or `.` commands on remote scripts.
## Command Injection Patterns - Watch for reverse shell patterns: `/dev/tcp/`, `nc -e`, `bash -i >& /dev/`. - Destructive commands like `rm -rf /`, `mkfs`, `dd if=`, and `shred` can cause irreversible data loss. - Be wary of download-and-execute chains: `curl ... && chmod +x && ./`. ## Supply Chain Security
## Command Injection Patterns - Watch for reverse shell patterns: `/dev/tcp/`, `nc -e`, `bash -i >& /dev/`. - Destructive commands like `rm -rf /`, `mkfs`, `dd if=`, and `shred` can cause irreversible data loss. - Be wary of download-and-execute chains: `curl ... && chmod +x && ./`. ## Supply Chain Security
- Watch for reverse shell patterns: `/dev/tcp/`, `nc -e`, `bash -i >& /dev/`. - Destructive commands like `rm -rf /`, `mkfs`, `dd if=`, and `shred` can cause irreversible data loss. - Be wary of download-and-execute chains: `curl ... && chmod +x && ./`. ## Supply Chain Security
60/60 vendors flagged this plugin as clean.
Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access
while ((next = coerceRtlRegex.exec(version)) && (!match || match.index + match[0].length !== version.length)) {const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);const envDir = process.env.CLAUDE_CONFIG_DIR;
var debug = typeof process === "object" && process.env && process.env.NODE_DEBUG && /\bsemver\b/i.test(process.env.NODE_DEBUG) ? (...args) => console.error("SEM...bn = process.env.TESTING_TAR_FAKE_PLATFORM || process.platform;