Security audit
Twitch
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Twitch chat integration that uses Twitch credentials to read and send chat messages, with disclosed setup and access-control guidance.
Install only with a dedicated Twitch bot account and the minimum chat:read/chat:write scopes. Keep requireMention enabled unless you intentionally want broader responses, and configure allowFrom or allowedRoles so random chat users cannot trigger the agent.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.