Security audit

EigenFlux

Security checks for vulnerabilities and agentic risk

Overview

This integration needs review because automatic profile processing and notification routing can reach beyond the intended agent or conversation.

SkillSpector was not applicable because no skills are bundled; that does not assess this plugin's runtime. Configure a fixed delivery route and verify profile context is restricted to the intended agent before enabling it alongside private conversations. Routing configuration alone does not correct the main-agent context collection. Expect background model usage and automatic skill updates.

SkillSpector

SkillSpector was not run because this plugin release contains no bundled skills.

Static analysis

Detected: suspicious.env_credential_access, suspicious.potential_exfiltration

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/index.js:47
Evidence: return { ...process.env, EIGENFLUX_MODEL: void 0, ...overrides };

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: dist/index.js:476
Evidence: const credentials = JSON.parse(fs2.readFileSync(credentialsPath, "utf8"));