Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- dist/index.js:4246
- Evidence
return Boolean((keyOverride ?? process.env.FIDACY_ENGINE_API_KEY ?? "").trim());
Security audit
Fidacy AI Agent Firewall
Security checks across malware telemetry and agentic risk
Overview
This is a disclosed payment-firewall and agent-observer plugin with local audit logs and documented remote telemetry/provisioning, with no artifact-backed deception or destructive behavior found.
Before installing, be comfortable with a plugin that watches agent tool calls, writes local audit/session files under ~/.fidacy, and by default may contact api.fidacy.com for anonymous telemetry and provisioning. Set FIDACY_DISABLE_TELEMETRY=1 and FIDACY_DISABLE_PROVISION=1, avoid operatorEmail, and leave FIDACY_MODE unset if you want local-only behavior.
SkillSpector
By NVIDIA
SkillSpector was not run because this plugin release contains no bundled skills.
VirusTotal
60/60 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.env_credential_access