Grades are a hygiene check, not a security guarantee.

Claude Code, Skill

Agent Skills

Build, migrate, debug, test, secure, and deploy Meteor 3 applications.

Compatibility: Not stated.

Grade B

Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

Rescanned at commit 40463f0183b7, unchanged since the check below.

NETWORK_NO_FIXED_HOST INSTALL_DOCUMENTED_INSTALLER SECRETS_ENV_READ

Why this grade

  • NETWORK_NO_FIXED_HOST Low

    Makes a network call whose host is not written as a fixed address.

    scripts/generate-catalog.mjs, line 93 ` $(curl -sf https://raw.githubusercontent.com/${repoSlug}/main/bundles.json \\`,

  • INSTALL_DOCUMENTED_INSTALLER Note

    Documentation shows an installer that pipes a download into a shell.

    skills/meteor-cli-installation/SKILL.md, line 74 | Linux or macOS alternative | `curl https://install.meteor.com/ \| sh` remains documented. Keep `npx meteor` as the primary cross-platform command. |

  • SECRETS_ENV_READ Note

    Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.

    skills/meteor-accounts/SKILL.md, line 151 secret: process.env.GOOGLE_CLIENT_SECRET,

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Pass

    No shell or command execution found, and no extra permission was declared.

  • Install and update

    Note

    The docs document an installer that pipes a download into a shell.

    INSTALL_DOCUMENTED_INSTALLER

    skills/meteor-cli-installation/SKILL.md, line 74

    | Linux or macOS alternative | `curl https://install.meteor.com/ \| sh` remains documented. Keep `npx meteor` as the primary cross-platform command. |

    skills/meteor-cli-installation/references/eval-cases.md, line 86

    Prompt: "Our macOS bootstrap uses `curl https://install.meteor.com/ | sh`.

    skills/meteor-cli-installation/references/installation-and-path.md, line 46

    curl https://install.meteor.com/ | sh

    Show more

    skills/meteor-deployment/references/docker.md, line 15

    RUN curl -sSL https://install.meteor.com/ | sh

    skills/meteor-testing/references/mocha-setup.md, line 67

    run: curl https://install.meteor.com/ | sh

    skills/migrate-to-meteor-3/references/eval-cases.md, line 393

    Prompt: "Our Linux setup uses `curl https://install.meteor.com/ | sh`. Must we

    skills/migrate-to-meteor-3/references/other-breaking-changes.md, line 222

    `curl https://install.meteor.com/ | sh` command remains an alternative for

  • Network

    Concern

    can reach a host that is not written as a fixed address.

    NETWORK_NO_FIXED_HOST

    scripts/generate-catalog.mjs, line 93

    ` $(curl -sf https://raw.githubusercontent.com/${repoSlug}/main/bundles.json \\`,

    skills/meteor-deployment/references/docker.md, line 11

    python3 make g++ git ca-certificates curl \

    skills/meteor-deployment/references/docker.md, line 84

    CMD node -e "fetch('http://localhost:'+(process.env.PORT||3000)).then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

    Show more

    skills/meteor-mongo-minimongo/SKILL.md, line 74

    const list = Posts.find({ ownerId }).fetch(); // client-only

    skills/meteor-testing/SKILL.md, line 181

    const docs = RemoteItems.find().fetch();

    skills/meteor-testing/references/ddp-test-helpers.md, line 49

    const docs = RemoteItems.find().fetch();

    skills/migrate-to-meteor-3/references/async-rewrites.md, line 210

    const res = await fetch(url, { headers });

    skills/migrate-to-meteor-3/references/eval-cases.md, line 17

    return Posts.find({ published: true }).fetch();

    skills/migrate-to-meteor-3/references/react-migration.md, line 24

    const posts = useTracker(() => Posts.find().fetch());

    skills/meteor-mongo-minimongo/SKILL.md, line 37

    3. Are you reading from a publication on the client? Use `find().fetch()`

  • Secrets

    Note

    reads an environment variable.

    SECRETS_ENV_READ

    skills/meteor-accounts/SKILL.md, line 151

    secret: process.env.GOOGLE_CLIENT_SECRET,

    skills/meteor-accounts/references/oauth-services.md, line 31

    secret: process.env.GOOGLE_CLIENT_SECRET,

    skills/meteor-community-packages/references/wormhole.md, line 27

    const apiKey = process.env.WORMHOLE_API_KEY;

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Pass

    No encoded or minified payload found.

  • Licence

    Pass

    A licence file is present (LICENSE).

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 40463f0183b7. The docs document an installer that pipes a download into a shell. can reach a host that is not written as a fixed address. reads an environment variable.

Date and source

Date checked:

View source

github.com

Commit graded: 40463f0183b764168cd64634f30fe634ab187e11

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen