Security audit

McPherson Governance Connector

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed shadow-mode governance connector that observes configured tool activity and writes local receipts, with no evidence of hidden enforcement or exfiltration.

Before installing, confirm you are comfortable sending metadata about tool activity to the governance endpoint you configure, keep tool names and labels non-sensitive, protect the local credential file, and treat the optional rotation operator as privileged. Also note the packaged CLI file was not executable in this artifact, so CLI use may require invoking it with node or a packaging fix.

SkillSpector

By NVIDIA

SkillSpector was not run because this plugin release contains no bundled skills.

VirusTotal

61/61 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/build-release-artifacts.mjs:38
Evidence: const result = spawnSync(command, args, {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/run-public-tests.mjs:139
Evidence: const r = spawnSync(process.execPath, ["--test", ...args], {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: tests/public-v051-regression.test.mjs:111
Evidence: const result = spawnSync(process.execPath, args, {