Security audit
Lobster
Security checks for vulnerabilities and agentic risk
Overview
This plugin coherently adds an optional workflow runner, but users should allow it only for agents that are meant to run side-effecting workflows.
Install only for agents that should run multi-step workflows. Keep the lobster tool optional, use a non-empty allowlist for any tools workflows may invoke, and review workflow files before approving side-effecting steps such as sending, posting, deleting, or account changes.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.