Security audit

Diffs

Security checks for vulnerabilities and agentic risk

Overview

This is a purpose-aligned diff viewer plugin that creates local viewer links and temporary PNG/PDF artifacts with disclosed limits and cleanup.

Reasonable to install if you want agents to produce shareable diffs. Treat generated viewer URLs and rendered files as containing whatever diff text you supplied, and only enable remote viewer access or a public viewerBaseUrl if those links may safely expose that content to anyone with the token URL.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

Detected: suspicious.obfuscated_code

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: dist/assets/viewer-runtime.js:1
Evidence: var vc=Object.defineProperty;var Nm=Object.getPrototypeOf;var Hm=Reflect.get;var Fc=e=>{throw TypeError(e)};var Gm=(e,t,n)=>t in e?vc(e,t,{enumerable:!0,configu...