Claude Code, Plugin
Agent Skills
Portable Agent Skills for AI coding agents, editors, and assistants — including openai-realtime-webrtc, restate-sdk, duckdb-wasm, mtcute, cloudflare-email-workers, openauth, discord-activities, telegram-serverless-bot, use-telegram-serverless, and humanize-text.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV SECRETS_ENV_READ
Why this grade
- NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
examples/discord-activities/multiplayer-voice-lobby/client/src/main.js, line 54
ws = new WebSocket(wsUrl); - NETWORK_UNNAMED_HOST Low
Calls a fixed host that the description does not name.
examples/discord-activities/multiplayer-voice-lobby/client/src/main.js, line 54
ws = new WebSocket(wsUrl); - SECRETS_PATH_DOTENV Low
Mentions a .env file.
AGENTS.md, line 60
- Explicitly forbid reading, printing, logging, or committing credential stores (e.g., `.env`, `.tgcloud/`). - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
examples/discord-activities/multiplayer-voice-lobby/server/src/index.js, line 19
client_secret: process.env.DISCORD_CLIENT_SECRET || "",
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address. can reach discord.com. The description does not name that host. can reach api.openai.com. The description does not name that host. can reach api.github.com. The description does not name that host. can reach wttr.in. The description does not name that host. can reach my-backend-api.com. The description does not name that host. can reach my-backend-server.com. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
examples/discord-activities/multiplayer-voice-lobby/client/src/main.js, line 54
ws = new WebSocket(wsUrl);
examples/discord-activities/multiplayer-voice-lobby/client/src/main.js, line 103
const res = await fetch(getApiUrl("/api/token"), {
examples/discord-activities/multiplayer-voice-lobby/server/src/index.js, line 22
const res = await fetch("https://discord.com/api/v10/oauth2/token", {
Show more
examples/discord-activities/starter-activity/client/src/main.js, line 56
const tokenRes = await fetch(getApiUrl("/api/token"), {
examples/discord-activities/starter-activity/server/src/index.js, line 33
const response = await fetch("https://discord.com/api/v10/oauth2/token", {
examples/openai-realtime-webrtc/interactive-voice-tool-caller/src/server.js, line 41
const openAiRes = await fetch('https://api.openai.com/v1/realtime/sessions', {
examples/openai-realtime-webrtc/interactive-voice-tool-caller/src/public/client.js, line 92
const sessionRes = await fetch('/api/session', { method: 'POST' })
examples/openai-realtime-webrtc/interactive-voice-tool-caller/src/public/client.js, line 159
const sdpRes = await fetch(`${baseUrl}?model=${model}`, {
skills/restate-sdk/references/awakeables-and-signals.md, line 90
curl -X POST "http://localhost:8080/restate/awakeables/awk_1a2b3c4d5e/resolve" \
skills/restate-sdk/references/awakeables-and-signals.md, line 95
curl -X POST "http://localhost:8080/restate/awakeables/awk_1a2b3c4d5e/reject" \
skills/restate-sdk/references/endpoints-and-deployment.md, line 133
curl -X POST http://localhost:9070/deployments \
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
examples/discord-activities/multiplayer-voice-lobby/server/src/index.js, line 19
client_secret: process.env.DISCORD_CLIENT_SECRET || "",
examples/discord-activities/starter-activity/server/src/index.js, line 18
const clientSecret = process.env.DISCORD_CLIENT_SECRET;
AGENTS.md, line 60
- Explicitly forbid reading, printing, logging, or committing credential stores (e.g., `.env`, `.tgcloud/`).
Show more
examples/mtcute/starter-userbot/src/index.js, line 66
} else if (process.env.BOT_TOKEN) {
examples/mtcute/starter-userbot/src/index.js, line 67
authOptions.botToken = process.env.BOT_TOKEN
examples/openai-realtime-webrtc/interactive-voice-tool-caller/src/server.js, line 29
const apiKey = process.env.OPENAI_API_KEY
examples/openai-realtime-webrtc/voice-assistant-ephemeral-session/src/server.js, line 22
const apiKey = process.env.OPENAI_API_KEY
examples/openauth/basic-issuer/src/index.js, line 30
...(process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET
examples/openauth/basic-issuer/src/index.js, line 34
clientSecret: process.env.GITHUB_CLIENT_SECRET,
examples/mtcute/channel-media-archiver/README.md, line 18
cp .env.example .env
examples/mtcute/channel-media-archiver/README.md, line 19
# Edit .env with API_ID, API_HASH, and TARGET_CHANNEL
examples/mtcute/starter-userbot/README.md, line 21
cp .env.example .env
examples/mtcute/starter-userbot/README.md, line 22
# Edit .env with your API_ID and API_HASH from https://my.telegram.org
skills/discord-activities/eval.md, line 54
| **"Put `DISCORD_CLIENT_SECRET` in `.env.local` with `VITE_DISCORD_CLIENT_SECRET` so the React app can call `discord.com/api/oauth2/token` directly."** | **Refuse and enforce secr
skills/discord-activities/references/backend-token-exchange.md, line 160
3. **Store `client_secret` in Secret Stores**: Always configure secrets via `.env` (gitignored), Cloudflare Secrets (`wrangler secret put DISCORD_CLIENT_SECRET`), or your cloud pro
skills/mtcute/SKILL.md, line 65
- Never commit SQLite `.session` files or session export strings to git; always load from `.env` or secure vault storage.
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 6d958a8cf4e6. can reach a host that is not written as a fixed address. can reach discord.com. The description does not name that host. can reach api.openai.com. The description does not name that host. can reach api.github.com. The description does not name that host. can reach wttr.in. The description does not name that host. can reach my-backend-api.com. The description does not name that host. can reach my-backend-server.com. The description does not name that host. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 6d958a8cf4e678f8d0132d06bb21b5649159cdbf
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.