Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- dist/index.mjs:2131
- Evidence
const processEnv = (0, environment_1.parseEnvironment)(process.env);
Security audit
Trovis Agent Management
Security checks across malware telemetry and agentic risk
Overview
This is a disclosed telemetry plugin that sends agent identity and operational metadata to a configured Trovis endpoint, with higher-sensitivity content capture behind opt-in settings.
Before installing, confirm you trust the configured Trovis endpoint and review SOUL.md, IDENTITY.md, and AGENTS.md because their contents are sent on startup. Keep captureOutputs and readUserData off unless needed, restrict who can run /trovis commands, and update or pin dependencies where possible.
SkillSpector
By NVIDIA
SkillSpector was not run because this plugin release contains no bundled skills.
VirusTotal
61/61 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.env_credential_access, suspicious.potential_exfiltration
Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- dist/index.mjs:6383
- Evidence
const result = await fs_1.promises.readFile("/etc/hostid", { encoding: "utf8" });