Claude Code, Skill
Agent Skills
Personal agent skills for planning, building, reviewing, and explaining software.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
INSTALL_LIFECYCLE_HOOK
Why this grade
- INSTALL_LIFECYCLE_HOOK Medium
A package install hook (preinstall, install, postinstall or prepare) runs a script.
package.json, line 8
prepare
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
scripts/check-installs.py, line 22
return subprocess.run(['git', *args], stdout=subprocess.PIPE, text=True, check=True).stdout
skills/agents/maintain-skills/scripts/catalog.py, line 34
result = subprocess.run(['git', '--no-optional-locks', '-C', str(repository), *arguments], capture_output=True, env=environment)
skills/agents/maintain-skills/scripts/catalog.py, line 576
shutil.rmtree(runs / name)
Show more
skills/agents/pstack-mode/scripts/worktree-audit.py, line 16
return subprocess.run(['git', '--no-optional-locks', '-C', str(repo), *args], capture_output=True, env=environment)
skills/agents/pstack-recall/scripts/history.py, line 17
return subprocess.run(['git', '--no-optional-locks', '-C', str(repo), *args], capture_output=True, env=environment)
skills/agents/pstack-swarm/scripts/review.py, line 17
process = subprocess.Popen(args, cwd=cwd, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, start_new_session=os.name == 'posix')
skills/engineering/pstack-statechart/scripts/render.mjs, line 57
fs.rmSync(tmp, { recursive: true, force: true });
skills/engineering/pstack-statechart/scripts/snapshot.mjs, line 42
process.on("exit", () => fs.rmSync(this.#root, { recursive: true, force: true }));
skills/engineering/pstack-statechart/scripts/statechart.mjs, line 214
fs.rmSync(metadir, { recursive: true, force: true });
skills/engineering/pstack-statechart/scripts/statechart.mjs, line 622
if (!keep) fs.rmSync(work, { recursive: true, force: true });
skills/engineering/pstack-statechart/scripts/statechart.mjs, line 644
if (sameFolder(to, claimed)) fs.rmSync(to, { recursive: true, force: true });
skills/engineering/pstack-statechart/scripts/statechart.mjs, line 649
fs.rmSync(from, { recursive: true, force: true });
skills/engineering/pstack-statechart/scripts/statechart.mjs, line 709
fs.rmSync(old, { recursive: true, force: true });
Install and update
Concern
runs a script at install time.
INSTALL_LIFECYCLE_HOOK
package.json, line 8
prepare
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
skills/agents/maintain-skills/scripts/catalog.py, line 531
def fetch(root, catalog, state, remotes=None):
skills/agents/maintain-skills/scripts/catalog.py, line 700
result = fetch(root, catalog, arguments.state.resolve(), remotes)
skills/engineering/tdd/mocking.md, line 44
getUser: (id) => fetch(`/users/${id}`),
Show more
skills/engineering/tdd/mocking.md, line 45
getOrders: (userId) => fetch(`/users/${userId}/orders`),
skills/engineering/tdd/mocking.md, line 46
createOrder: (data) => fetch("/orders", { method: "POST", body: data }),
skills/engineering/tdd/mocking.md, line 51
fetch: (endpoint, options) => fetch(endpoint, options),
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
skills/agents/pstack-mode/scripts/orch/orch.ts, line 240
.addOption(new Option("--store <dir>", "store directory (or ORCH_STORE)").env("ORCH_STORE"))
skills/agents/pstack-mode/scripts/orch/orch.ts, line 438
.addOption(new Option("--repo <dir>", "repository directory (or ORCH_REPO)").env("ORCH_REPO"))
skills/agents/wizard/template.sh, line 26
ENV_FILE="${ENV_FILE:-.env}"
Show more
skills/agents/wizard/template.sh, line 100
# ask KEY "Prompt" reads a value into $KEY. Offers the existing .env value as
skills/engineering/tdd/mocking.md, line 32
const client = new StripeClient(process.env.STRIPE_KEY);
skills/agents/wizard/SKILL.md, line 8
A **wizard** is a bash script that walks a human, step by step, through a manual procedure that's tedious to do by hand and tedious to re-explain to an AI every time. It opens each
skills/agents/wizard/SKILL.md, line 10
The delightful UX is already solved by [template.sh](template.sh): stage-by-stage progress, confirmation gates, cross-platform URL opening (including WSL), hidden secret entry, ide
skills/agents/wizard/SKILL.md, line 20
- For setup: `.env`, `.env.example`, `.env.*`, `README`, `docker-compose*`, framework config, and `.github/workflows/*` (every `secrets.*` / `vars.*` reference is a value the wizar
skills/agents/wizard/SKILL.md, line 25
**Done when:** every stage is named in order, and for each captured value you know (a) where the human gets it, (b) where it's written (`.env`, a GitHub secret, both, or nowhere; s
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read. the file cap was reached before every file was read.
OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED
skills/engineering/pstack-statechart/scripts/test/statechart.test.mjs, line 1
import assert from "node:assert/strict";
skills/planning/pstack-architect/SKILL.md, line 1
---
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit b3e012e4af37. can delete files. runs a script at install time. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.
Date and source
Date checked:
github.com
Commit graded: b3e012e4af3770630c1c223e9a54c2b71f0631be
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.