Security audit

Diffs

Security checks for vulnerabilities and agentic risk

Overview

This plugin coherently provides a diff viewer and temporary PNG/PDF renderer, with disclosed local artifact storage and scoped viewer access controls.

Before installing, treat rendered diffs and viewer URLs as potentially sensitive if the diff content contains secrets or private code. Keep remote viewer access disabled unless you intentionally need token URL access outside loopback, and rely on the TTL settings to limit artifact lifetime.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

Detected: suspicious.obfuscated_code

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: dist/assets/viewer-runtime.js:1
Evidence: var Hc=Object.defineProperty;var Ym=Object.getPrototypeOf;var Km=Reflect.get;var Gc=e=>{throw TypeError(e)};var Om=(e,t,n)=>t in e?Hc(e,t,{enumerable:!0,configu...