Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- dist/index.js:998
- Evidence
for (const [key, value] of Object.entries(process.env)) {
Security audit
Web Search Plus
Security checks for vulnerabilities and agentic risk
Overview
The plugin is a coherent, disclosed web search and extraction integration that uses external providers and optional local DonSeTch execution in purpose-aligned, bounded ways.
Install only if you are comfortable sending search queries and extracted URLs to the providers you configure. Review TinyFish terms before using it, and enable DonSeTch or private-network extraction only after local operator review because those expand local process and network behavior.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.env_credential_access