Grades are a hygiene check, not a security guarantee.

Claude Code, Plugin

Agent Plus

A framework for building deterministic CLI tools that Claude Code shells out to.

Compatibility: Not stated.

Grade B

Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

Rescanned at commit 10f2dfd0095d, unchanged since the check below.

PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV INSTALL_DOCUMENTED_INSTALLER

Why this grade

  • PERMISSION_DELETE_FILES Low

    Contains a call that can delete files.

    agent-plus-meta/bin/_subcommands/init.py, line 339 Compatible with cmd.exe (subprocess.Popen with shell=True) since we

  • NETWORK_NO_FIXED_HOST Low

    Makes a network call whose host is not written as a fixed address.

    install.ps1, line 116 # file:// URIs. curl (used by install.sh) handles file:// natively;

  • SECRETS_PATH_DOTENV Low

    Mentions a .env file.

    evals/scripts/bootstrap_fixtures.py, line 41 ".env", ".env.local", ".env.production", ".env.development",

  • INSTALL_DOCUMENTED_INSTALLER Note

    Documentation shows an installer that pipes a download into a shell.

    AGENTS.md, line 25 curl -fsSL https://github.com/osouthgate/agent-plus/releases/latest/download/install.sh | sh

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Concern

    can delete files.

    PERMISSION_DELETE_FILES

    agent-plus-meta/bin/_subcommands/init.py, line 339

    Compatible with cmd.exe (subprocess.Popen with shell=True) since we

    agent-plus-meta/bin/_subcommands/init.py, line 554

    proc = subprocess.run(shell_cmd, capture_output=True, text=True,

    agent-plus-meta/bin/_subcommands/init.py, line 558

    proc = subprocess.run([exe] + remaining_args, capture_output=True, text=True,

    Show more

    agent-plus-meta/bin/_subcommands/init.py, line 588

    proc = subprocess.run(shell_cmd, capture_output=True, text=True,

    agent-plus-meta/bin/_subcommands/init.py, line 592

    proc = subprocess.run([exe] + remaining_args, capture_output=True, text=True,

    agent-plus-meta/bin/_subcommands/init.py, line 804

    out = subprocess.run(

    agent-plus-meta/bin/_subcommands/init.py, line 980

    _mp_result = subprocess.run(

    agent-plus-meta/bin/_subcommands/init.py, line 1005

    _inst = subprocess.run(

    agent-plus-meta/bin/_subcommands/uninstall.py, line 438

    # Self-delete handling (E1): on Windows, `os.remove()` on the

    evals/scripts/bootstrap_fixtures.py, line 177

    shutil.rmtree(path, ignore_errors=True)

    evals/scripts/bootstrap_fixtures.py, line 179

    shutil.rmtree(path)

    skill-plus/bin/_subcommands/globalize.py, line 108

    shutil.rmtree(str(destination))

    skill-plus/bin/_subcommands/localize.py, line 96

    shutil.rmtree(str(destination))

    skill-plus/bin/_subcommands/promote.py, line 474

    shutil.rmtree(str(source_skill))

  • Install and update

    Note

    The docs document an installer that pipes a download into a shell. README documents an installer that pipes a download into a shell.

    INSTALL_DOCUMENTED_INSTALLER

    AGENTS.md, line 25

    curl -fsSL https://github.com/osouthgate/agent-plus/releases/latest/download/install.sh | sh

    README.md, line 13

    curl -fsSL https://github.com/osouthgate/agent-plus/releases/latest/download/install.sh | sh

    README.md, line 95

    curl -fsSL https://github.com/osouthgate/agent-plus/releases/latest/download/install.sh | sh

    Show more

    README.md, line 186

    curl -fsSL https://github.com/osouthgate/agent-plus/releases/latest/download/install.sh | sh

    README.md, line 231

    curl -fsSL https://github.com/osouthgate/agent-plus/releases/latest/download/install.sh | sh

    install.sh, line 9

    # curl -fsSL https://raw.githubusercontent.com/osouthgate/agent-plus/main/install.sh | sh

    agent-plus-meta/bin/_subcommands/uninstall.py, line 520

    "Re-install: curl -fsSL https://raw.githubusercontent.com/osouthgate/agent-plus/main/install.sh | sh"

    agent-plus-meta/docs/uninstall-envelope.md, line 66

    "Re-install: curl -fsSL https://raw.githubusercontent.com/osouthgate/agent-plus/main/install.sh | sh"

    agent-plus-meta/skills/agent-plus-installer/SKILL.md, line 48

    curl -fsSL https://raw.githubusercontent.com/osouthgate/agent-plus/main/install.sh | sh -s -- --unattended

    agent-plus-meta/skills/agent-plus-installer/SKILL.md, line 118

    curl -fsSL https://raw.githubusercontent.com/osouthgate/agent-plus/main/install.sh | sh -s -- --unattended

  • Network

    Concern

    can reach a host that is not written as a fixed address.

    NETWORK_NO_FIXED_HOST

    install.ps1, line 116

    # file:// URIs. curl (used by install.sh) handles file:// natively;

    install.sh, line 195

    json=$(curl -fsSL "$api" 2>/dev/null || true)

    install.sh, line 467

    if ! command -v curl >/dev/null 2>&1; then

    Show more

    install.sh, line 468

    echo "install.sh: curl is required but not found on PATH" >&2

    install.sh, line 470

    echo "[install_sh_curl_failed] env: curl not on PATH" >&2

    install.sh, line 511

    if curl -fsSL "$ASSET_TARBALL" -o "$TARBALL_PATH" 2>/dev/null; then

    install.sh, line 516

    if ! curl -fsSL "$AUTOARCHIVE_TARBALL" -o "$TARBALL_PATH"; then

    install.sh, line 528

    if ! curl -fsSL "$AUTOARCHIVE_TARBALL" -o "$TARBALL_PATH"; then

  • Secrets

    Concern

    reads a credential or environment file.

    SECRETS_PATH_DOTENV

    evals/scripts/bootstrap_fixtures.py, line 41

    ".env", ".env.local", ".env.production", ".env.development",

    evals/scripts/bootstrap_fixtures.py, line 47

    ".env",

    evals/scripts/bootstrap_fixtures.py, line 203

    if name.startswith(".env"):

    Show more

    scripts/install-precommit.sh, line 14

    # maintainer's `~/.env` or shell env vars (e.g. LINEAR_API_KEY) trigger

    skill-plus/bin/_subcommands/scaffold.py, line 93

    "- Layered config: `--env-file` → `<repo>/.env.local` → `<repo>/.env` → `~/.agent-plus/.env` → shell.\n"

    skill-plus/bin/_subcommands/scaffold.py, line 279

    layers.append(_parse_dotenv(Path.home() / ".agent-plus" / ".env"))

    skill-plus/bin/_subcommands/scaffold.py, line 281

    layers.append(_parse_dotenv(top / ".env"))

    skill-plus/bin/_subcommands/scaffold.py, line 282

    layers.append(_parse_dotenv(top / ".env.local"))

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Pass

    No encoded or minified payload found.

  • Licence

    Pass

    A licence file is present (LICENSE).

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 10f2dfd0095d. can delete files. The docs document an installer that pipes a download into a shell. README documents an installer that pipes a download into a shell. can reach a host that is not written as a fixed address. reads a credential or environment file.

Date and source

Date checked:

View source

github.com

Commit graded: 10f2dfd0095d1a384cc7edfeaee414c9196d927a

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen