Security audit
nmbr
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed nmbr chat-channel plugin that lets approved nmbr users talk to and approve prompts for the agent, with no hidden install scripts or unrelated local access found.
Install this only if you trust the nmbr service and package publisher. Keep the agent token private, use pairing or an allowlist for trusted nmbrs, and avoid dmPolicy=open unless you intend any permitted nmbr contact to drive the agent.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.