Security audit

DebugBundle

Security checks for vulnerabilities and agentic risk

Overview

DebugBundle is a disclosed monitoring and incident-response plugin with broad but purpose-aligned access that should only be installed where DebugBundle account access is intended.

Install this only in workspaces where you want an agent to use DebugBundle and any existing DebugBundle CLI/member authentication. Keep optional mutation tools allowlisted only for trusted operators, especially billing, project deletion, member management, token creation/revocation, probes, webhooks, alerts, and generated local scaffold writes. Use a trusted API base URL and prefer project-scoped reads for incidents and analytics.

SkillSpector

SkillSpector was not run because this plugin release contains no bundled skills.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.env_credential_access, suspicious.potential_exfiltration

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: dist/index.js:589
Evidence: var deprecatedfn2 = new Function(

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/index.js:446
Evidence: var str = process.env.NO_DEPRECATION || "";

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: dist/index.js:74637
Evidence: rawAuthState = await readFile(authFilePath);