Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- dist/index.js:1022
- Evidence
for (const [key, value] of Object.entries(process.env)) {
Security audit
Web Search Plus
Security checks for vulnerabilities and agentic risk
Overview
This plugin’s web search, extraction, provider credential use, optional local DonSeTch execution, and process-local caching are disclosed and aligned with its stated purpose.
Before installing, enable only the tools and providers you need, review each provider’s data-use terms before sending sensitive queries or URLs, and treat DonSeTch, keyless public tiers, and private-network extraction flags as operator-controlled advanced options.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.env_credential_access