Security audit
Talk2Stock
Security checks for vulnerabilities and agentic risk
Overview
This plugin mostly matches its business-management purpose, but it exposes an undeclared batch-order tool that can create real customer orders without the approval flow the documentation promises.
Review this before installing if an agent may handle real orders. The plugin needs a Talk2Stock API key and can change business records; in particular, the batch-order tool can create real orders without the documented draft-and-confirm flow, so use it only if you are comfortable enforcing approvals operationally or after the publisher fixes the manifest and approval guard.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.