Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- dist/index.js:4248
- Evidence
const b64 = process.env.FIDACY_SIGNING_KEY_B64;
Security audit
Fidacy AI Agent Firewall
Security checks for vulnerabilities and agentic risk
Overview
This plugin performs a disclosed local audit and firewall role, with sensitive monitoring called out clearly and no evidence of hidden exfiltration or destructive behavior.
Install only if you are comfortable with a plugin that observes agent tool activity and writes audit/session history under ~/.fidacy. Configure the Fidacy API key and engine URL deliberately, and review or delete local history if the recorded command/tool metadata is sensitive for your environment.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.env_credential_access