Security audit

Diffs

Security checks for vulnerabilities and agentic risk

Overview

This plugin coherently provides a local diff viewer and PNG/PDF renderer, with bounded temporary artifacts and no evidence of hidden or unrelated behavior.

Before installing, understand that agents will get a startup-available diff tool and prompt guidance encouraging its use. Rendered diffs may contain whatever text the agent provides, so avoid sharing viewer URLs or generated files for sensitive content unless intended; keep remote viewer access disabled unless you have deliberately configured a trusted gateway/proxy setup.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

Detected: suspicious.obfuscated_code

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: dist/assets/viewer-runtime.js:1
Evidence: var Hc=Object.defineProperty;var Ym=Object.getPrototypeOf;var Km=Reflect.get;var Gc=e=>{throw TypeError(e)};var Om=(e,t,n)=>t in e?Hc(e,t,{enumerable:!0,configu...