I'm super late to the game here, sorry for not being more involved in this convo from the get-go, but I've really been digging the responses I've seen. Imo, the efigy table is something that would do better in an extension table, largely in part due to many of the mentioned concerns in the channel, such as this would entail osquery reaching out to ask about information from a remote service, whereas much* of osquery table data is derived locally. If we could get a statically built Efigy lib that'd be awesome to ship alongside osquery, but considering this feature might be something not necessarily used by all, it seems it'd be best suited in an extension. I feel this brings us to a broader discussion that a few folks touched on above, which is, what can we do to better foster the extensions platform? I feel that there's loads of really cool examples of extensions that folks have implemented, and a platform through which extensions could be shared might be valuable.