Claude Code, Skill
Agent Alchemy
A plugin suite and developer toolkit that extends Claude Code into a structured development platform — from specs to tasks to autonomous execution.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
SECRETS_PATH_CREDENTIAL
Why this grade
- SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
agent-tools/src/agent_tools/sources/git.py, line 261
"For SSH: ssh-add ~/.ssh/id_ed25519 or check ~/.ssh/config. "
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Note
requests shell access. The manifest names this permission.
PERMISSION_SHELL_DECLARED
agent-tools/src/agent_tools/sources/git.py, line 107
result = subprocess.run(
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
agent-tools/src/agent_tools/sources/registry.py, line 257
with urllib.request.urlopen(req, timeout=30) as resp:
apps/task-manager/src/lib/api.ts, line 19
const response = await fetch(`${API_BASE}/task-lists`)
apps/task-manager/src/lib/api.ts, line 28
const response = await fetch(`${API_BASE}/tasks/${encodeURIComponent(taskListId)}`)
Show more
apps/task-manager/src/lib/api.ts, line 39
const response = await fetch(
claude/core-tools/skills/language-patterns/SKILL.md, line 56
const response = await fetch('/api/data');
claude/core-tools/skills/language-patterns/SKILL.md, line 99
const response = await fetch(`/api/users/${id}`);
ported/20260304-102613/core-tools/skills/language-patterns/SKILL.md, line 55
const response = await fetch('/api/data');
ported/20260304-102613/core-tools/skills/language-patterns/SKILL.md, line 98
const response = await fetch(`/api/users/${id}`);
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
agent-tools/src/agent_tools/sources/git.py, line 261
"For SSH: ssh-add ~/.ssh/id_ed25519 or check ~/.ssh/config. "
claude/claude-tools/skills/claude-code-teams/references/orchestration-patterns.md, line 720
rer found that JWT_SECRET is loaded from .env but you noted tokens are validated in m
.gitignore, line 37
# Environment files
Show more
.gitignore, line 39
!.env.example
agent-tools/README.md, line 357
- **SSH**: Ensure your SSH key is loaded (`ssh-add ~/.ssh/id_ed25519`) and the remote host is in `~/.ssh/config`.
claude/plugin-tools/references/mcp-converter.md, line 52
| `mcpServers.<name>.env` | object | No | Environment variables to set for the server process. Values may contain `${CLAUDE_PLUGIN_ROOT}` for path resolution. |
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
the file cap was reached before every file was read.
OBFUSCATION_FILE_CAP_REACHED
ported/20260305-085418/core-tools/skills/technical-diagrams/references/er-diagrams.md, line 1
# ER Diagrams Reference
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit fc1a336b8267. requests shell access. The manifest names this permission. can reach a host that is not written as a fixed address. reads a credential or environment file. the file cap was reached before every file was read.
Date and source
Date checked:
github.com
Commit graded: fc1a336b8267e70579af8517d14718e626824e54
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.