Security audit

Diffs

Security checks for vulnerabilities and agentic risk

Overview

This package is a disclosed read-only diff viewer that temporarily renders user-provided diff content into local viewer links or PNG/PDF files.

Install only if you are comfortable with agents rendering provided diff text into temporary local artifacts. Treat returned viewer URLs as bearer links to the rendered diff, especially if remote viewer access is enabled or a public viewerBaseUrl is configured.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

Detected: suspicious.obfuscated_code

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: dist/assets/viewer-runtime.js:1
Evidence: var Hc=Object.defineProperty;var Ym=Object.getPrototypeOf;var Km=Reflect.get;var Gc=e=>{throw TypeError(e)};var Om=(e,t,n)=>t in e?Hc(e,t,{enumerable:!0,configu...