Claude Code, Plugin
Agent Plus Skills
osouthgate's marketplace of agent-plus service wrappers — Claude Code plugins that collapse slow, multi-step API dances into one fast call across deploys, databases, cloud, billing, and logs.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit ad452303e56b, unchanged since the check below.
SECRETS_PATH_CREDENTIAL
Why this grade
- SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
coolify-remote/skills/coolify-remote/SKILL.md, line 54
COOLIFY_SSH_KEY=~/.ssh/agent-plus # default: ssh's own defaults
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Note
requests shell access. The manifest names this permission.
PERMISSION_SHELL_DECLARED
coolify-remote/bin/coolify-remote, line 413
result = subprocess.run(ssh_cmd)
github-remote/bin/github-remote, line 231
proc = subprocess.run(
github-remote/bin/github-remote, line 281
proc = subprocess.run(
Show more
hcloud-remote/bin/hcloud-remote, line 555
sys.exit(subprocess.call(cmd))
hermes-remote/bin/hermes-remote, line 283
out = subprocess.run(
railway-ops/README.md, line 204
- Shells out to `railway` via `subprocess.run` with a 30s timeout per call.
railway-ops/bin/railway-ops, line 204
subprocess.run() without shell=True won't find .cmd files via bare name
railway-ops/bin/railway-ops, line 226
proc = subprocess.run(
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
coolify-remote/skills/coolify-remote/SKILL.md, line 123
coolify-remote app exec hermes -- sh -c 'curl -sf http://localhost:3000/health' \
coolify-remote/bin/coolify-remote, line 238
with urllib.request.urlopen(req, timeout=timeout) as resp:
coolify-remote/bin/coolify-remote, line 885
with urllib.request.urlopen(req, timeout=10) as resp:
Show more
coolify-remote/bin/coolify-remote, line 956
with urllib.request.urlopen(req, timeout=8) as resp:
github-remote/bin/github-remote, line 405
with urllib.request.urlopen(req, timeout=timeout) as resp:
github-remote/bin/github-remote, line 800
with urllib.request.urlopen(loc, timeout=60) as resp:
github-remote/bin/github-remote, line 1544
with urllib.request.urlopen(req, timeout=8) as resp:
hcloud-remote/bin/hcloud-remote, line 194
with urllib.request.urlopen(req, timeout=timeout) as resp:
hcloud-remote/bin/hcloud-remote, line 519
with urllib.request.urlopen(req, timeout=8) as resp:
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
coolify-remote/skills/coolify-remote/SKILL.md, line 47
# .env (project-level, preferred)
coolify-remote/skills/coolify-remote/SKILL.md, line 54
COOLIFY_SSH_KEY=~/.ssh/agent-plus # default: ssh's own defaults
coolify-remote/skills/coolify-remote/SKILL.md, line 75
coolify-remote env sync <app> .env [--prefix HERMES_] [--deploy] [--wait]
Show more
coolify-remote/skills/coolify-remote/SKILL.md, line 110
coolify-remote app exec hermes -- sh -c 'cat /app/.env | wc -l'
coolify-remote/skills/coolify-remote/SKILL.md, line 188
coolify-remote env sync hermes .env --prefix HERMES_ --deploy --wait
hcloud-remote/skills/hcloud-remote/SKILL.md, line 45
# .env
hcloud-remote/skills/hcloud-remote/SKILL.md, line 116
hcloud-remote ssh my-vps-01 --user admin -- -p 2222 -i ~/.ssh/hetzner 'uptime'
langfuse-remote/skills/langfuse-remote/SKILL.md, line 35
cd /path/to/my-app # has .env with LANGFUSE_BASE_URL=... etc
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit ad452303e56b. requests shell access. The manifest names this permission. can reach a host that is not written as a fixed address. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: ad452303e56b5e02420148ba46c324a48a4b0ef8
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.