Claude Code, Skill
Agent Peer
Agent Peer has PlugVet grade C (One medium finding) from our automated hygiene checks. Finding: mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc). This is a hygiene check, not a security audit or a guarantee. Graded on 19/10/2026.
Agent Peer, a skill listed in the PlugVet directory.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit e45efc6205ba, unchanged since the check below.
SECRETS_PATH_CREDENTIAL
Why this grade
- SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
agent_peer/claude_status.py, line 19
CREDENTIALS_FILE = Path.home() / ".claude" / ".credentials.json"
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
agent_peer/agy_live.py, line 34
raw = subprocess.run(
agent_peer/claude_status.py, line 46
raw = subprocess.run(
agent_peer/codex_status.py, line 19
proc = subprocess.Popen(
Show more
agent_peer/compat.py, line 27
subprocess.run(["icacls", path, "/inheritance:r", "/grant:r", f"{user}:(F)"],
agent_peer/compat.py, line 40
subprocess.run(["icacls", path, "/inheritance:r", "/grant:r", f"{user}:(OI)(CI)(F)"],
agent_peer/compat.py, line 201
out = subprocess.check_output(["ps", "-o", f"{field}=", "-p", str(pid)], stderr=subprocess.DEVNULL)
agent_peer/compat.py, line 210
res = subprocess.check_output(cmd, env=env, stderr=subprocess.DEVNULL)
agent_peer/listener.py, line 351
subprocess.Popen(
agent_peer/setup_tui.py, line 43
os.remove(target)
Install and update
Note
README documents an installer that pipes a download into a shell.
INSTALL_DOCUMENTED_INSTALLER
README.md, line 75
curl -fsSL https://raw.githubusercontent.com/mkhuda/agent-peer/main/install.sh | sh
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
agent_peer/agy_live.py, line 168
with urllib.request.urlopen(req, timeout=10) as resp:
agent_peer/claude_status.py, line 76
with urllib.request.urlopen(req, timeout=10) as resp:
agent_peer/claude_status.py, line 91
with urllib.request.urlopen(req, timeout=10) as resp:
Show more
agent_peer/claude_status.py, line 103
with urllib.request.urlopen(req, timeout=5) as resp:
agent_peer/status_tui.py, line 82
status = fetch()
agent_peer/telegram_bridge.py, line 142
with urllib.request.urlopen(req, timeout=timeout) as resp:
agent_peer/update_check.py, line 49
with urllib.request.urlopen(PYPI_URL, timeout=timeout) as response:
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
agent_peer/claude_status.py, line 19
CREDENTIALS_FILE = Path.home() / ".claude" / ".credentials.json"
agent_peer/claude_status.py, line 114
return None, None, "No Claude Code credentials found (keychain or ~/.claude/.credentials.json)."
agent_peer/telegram_bridge.py, line 68
project `.env` cannot leak its other secrets into the child agent-peer processes."""
Show more
.gitignore, line 25
.agent-peer/
CHANGELOG.md, line 153
`~/.agent-peer/telegram.env`, never from a project `.env`.
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit e45efc6205ba. can delete files. README documents an installer that pipes a download into a shell. can reach a host that is not written as a fixed address. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: e45efc6205baeeea1c0f6fa174800dc47fada4cb
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.