"sourceUrl":"https://github.com/ckelsoe/obsidian-developer-toolbox/blob/refs/tags/0.10.4/lib/manifest-version.ts#L15"},{"id":1079295,"pluginId":"developer-toolbox","version":"0.10.4","category":"filesystem_access","severity":"info","filePath":"lib/path-redact.ts","lineNumber":2,"codeSnippet":"process.env","explanation":"process.env access reads environment variables","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/ckelsoe/obsidian-developer-toolbox/blob/refs/tags/0.10.4/lib/path-redact.ts#L2"},{"id":1079296,"pluginId":"developer-toolbox","version":"0.10.4","category":"permissions_scope","severity":"info","filePath":"tools/command-inspector/modal.ts","lineNumber":32,"codeSnippet":"app.commands","explanation":"Accesses Obsidian API: app.commands","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/ckelsoe/obsidian-developer-toolbox/blob/refs/tags/0.10.4/tools/command-inspector/modal.ts#L32"},{"id":1079297,"pluginId":"developer-toolbox","version":"0.10.4","category":"obfuscation","severity":"info","filePath":"tools/issue-capture/annotation/stage.ts","lineNumber":12,"codeSnippet":"atob(data)","explanation":"Decodes base64-encoded strings using atob()","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/ckelsoe/obsidian-developer-toolbox/blob/refs/tags/0.10.4/tools/issue-capture/annotation/stage.ts#L12"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"0.10.3","initialDiffTo":"0.10.4","summary":"The plugin confirms it reads a single file from the vault through the file adapter, and it decodes some built-in strings with `atob()`. It can capture annotated screenshots with structured context, reload plugins live, and inspect icons, CSS variables, and commands when those features are used. No network activity was observed, so based on the available review it does not send data to any external endpoints.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.2","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":">=2.0.0 <2.1.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.16","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":"<1.1.16","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=3.0.0 <5.0.7","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":">=3.0.0 <5.0.7","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.17","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":"<1.1.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.3","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":">=2.0.0 <2.1.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=4.0.0 <5.0.8","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-

Developer Toolbox