Grades are a hygiene check, not a security guarantee.

Claude Code, Skill

Agent Skills

TRTC AI Integration Assistant - helps developers integrate Tencent Real-Time Communication SDKs (Chat, Call, RTC Engine, Live, Conference) across Web, Android, iOS, Flutter, and Electron.

Compatibility: Not stated.

Grade D

Two or more Medium findings, or a High finding. Only try it in a sandbox.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

Rescanned at commit 55a6bcf643ac, unchanged since the check below.

Pattern found, check before installing

The checks matched a pattern that needs a closer look. It does not mean the code is harmful. Read the quoted lines below.

  • NETWORK_HOST_FROM_INPUT High

    host from input plus a credential path in operative code

NETWORK_HOST_FROM_INPUT SECRETS_PATH_CREDENTIAL OBFUSCATION_MINIFIED_PAYLOAD

Why this grade

  • NETWORK_HOST_FROM_INPUT High

    A file takes a URL or endpoint as input and has no fixed host list.

    scripts/validate_api_docs.py, line 59 r = requests.get(url, timeout=TIMEOUT, allow_redirects=True,

  • SECRETS_PATH_CREDENTIAL Medium

    Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).

    scripts/publish-npm.js, line 19 fs.writeFileSync(path.resolve(os.homedir(), '.npmrc'), `//registry.npmjs.org/:_authToken=${npmToken}`);

  • OBFUSCATION_MINIFIED_PAYLOAD Medium

    Contains a very long line with almost no spaces in a script or style file.

    knowledge-base/docs/chat/debug/lib-generate-test-usersig.min.js, line 1 !function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e=e||self).LibGenerateTestUserSig=t()}(this,

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

If you think this grade is wrong, email [email protected] with the entry link and your evidence. We aim to acknowledge within two working days and decide within seven. If we confirm an error, we aim to correct it within 24 hours of confirming it. These are aims, not guarantees.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Concern

    can delete files.

    PERMISSION_DELETE_FILES

    bin/cli.js, line 475

    try { fs.unlinkSync(tmp); } catch (err) { if (err?.code !== "ENOENT") throw err; }

    bin/cli.js, line 715

    try { fs.unlinkSync(staleFile); } catch { /* ignore */ }

    bin/cli.js, line 719

    try { fs.unlinkSync(path.join(path.dirname(lockPath), e)); } catch { /* ignore */ }

    Show more

    bin/cli.js, line 737

    try { fs.unlinkSync(releasingFile); } catch { /* ignore */ }

    bin/cli.js, line 742

    fs.unlinkSync(releasingFile);

    bin/cli.js, line 744

    try { fs.unlinkSync(releasingFile); } catch { /* ignore */ }

    bin/cli.js, line 840

    fs.rmSync(target, { recursive: true, force: true });

    bin/cli.js, line 2027

    try { fs.unlinkSync(tmp); } catch { /* ignore */ }

    hooks/cursor-adapter.py, line 310

    proc = subprocess.run(

    scripts/cli-c19-migration.test.js, line 1269

    "proc = subprocess.Popen(['npx', '--yes', '@tencent-rtc/skill-tool@latest'], stdin=subprocess.PIPE, stdout=subprocess.PIPE, text=True, env=os.environ)",

    skills/trtc/runtime/telemetry_collector.py, line 204

    proc = subprocess.Popen(

    skills/trtc/runtime/lib/platforms.py, line 94

    proc = subprocess.run(

    skills/trtc/runtime/lib/platforms.py, line 123

    proc = subprocess.run(

    skills/trtc/runtime/lib/platforms.py, line 153

    proc = subprocess.run(

    skills/trtc/tools/session.py, line 210

    # option 3: hook 改成走 CLI（subprocess.run [python, -m, tools.session, ...]）

    .claude/skills/trtc-eval/scripts/case_runner_orchestrator.py, line 60

    proc = subprocess.run(

  • Install and update

    Pass

    No install-time script found, and dependencies are pinned or absent.

  • Network

    Serious

    accepts a host from input, with no fixed list in this file.

    NETWORK_HOST_FROM_INPUT

    scripts/validate_api_docs.py, line 59

    r = requests.get(url, timeout=TIMEOUT, allow_redirects=True,

    skills/trtc/runtime/redact.js, line 126

    // embeds headers inside curl commands, Markdown bullets or quoted code, so the

    skills/trtc-ai-oral-coach/auto_adapters/integration_templates/generic-integration.md, line 62

    curl -sS -X POST http://localhost:8000/api/v1/config \

    Show more

    skills/trtc-ai-oral-coach/auto_adapters/integration_templates/generic-integration.md, line 69

    curl -sS -X POST http://localhost:8000/api/v1/agent/start \

    skills/trtc-ai-oral-coach/auto_adapters/integration_templates/generic-integration.md, line 85

    curl -sS -X POST http://localhost:8000/api/v1/correct \

    skills/trtc-ai-oral-coach/auto_adapters/integration_templates/generic-integration.md, line 90

    curl -sS -X POST http://localhost:8000/api/v1/suggest \

    skills/trtc-ai-oral-coach/auto_adapters/integration_templates/generic-integration.md, line 95

    curl -sS -X POST http://localhost:8000/api/v1/report \

    skills/trtc-ai-oral-coach/capabilities/conversation-core/src/core/report_llm.py, line 87

    resp = requests.post(self.api_url, headers=headers, json=payload, timeout=timeout)

    skills/trtc-ai-oral-coach/capabilities/custom-learning-kb/src/adapters/clients.py, line 63

    resp = requests.post(url, headers=headers, json=_payload("hybrid_search"), timeout=(5, 8))

    skills/trtc-ai-oral-coach/capabilities/custom-learning-kb/src/adapters/clients.py, line 67

    resp = requests.post(url, headers=headers, json=_payload("keyword_search"), timeout=(5, 8))

    skills/trtc-ai-oral-coach/capabilities/custom-learning-kb/src/adapters/clients.py, line 90

    resp = requests.post(url, headers={"Authorization": f"Bearer {self.key}"},

    skills/trtc-ai-oral-coach/capabilities/custom-learning-kb/src/adapters/clients.py, line 114

    resp = requests.post(self.base, headers=headers,

    skills/trtc-ai-realtime-interpreter/SKILL.md, line 370

    sleep 8 && curl -k -sS https://localhost:8020/api/v1/health

    skills/trtc-ai-realtime-interpreter/SKILL.md, line 377

    curl -k -sS https://localhost:8020/ | head -5

    skills/trtc-ai-realtime-interpreter/SKILL.md, line 378

    curl -k -sS -o /dev/null -w "JS HTTP %{http_c

    skills/trtc-ai-realtime-interpreter/SKILL.md, line 379

    curl -k -sS -o /dev/null -w "CSS HTTP %{http_

    skills/trtc-ai-realtime-interpreter/SKILL.md, line 600

    sleep 8 && curl -sS http://localhost:8020/api/v1/health

  • Secrets

    Concern

    reads a credential or environment file.

    SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

    bin/cli.js, line 1806

    lines.push(`[mcp_servers.${serverName}.env]`);

    bin/cli.js, line 1921

    const ENV_HEADER = `[mcp_servers.${LEGACY_REPORTING_MCP_NAME}.env]`;

    scripts/publish-npm.js, line 19

    fs.writeFileSync(path.resolve(os.homedir(), '.npmrc'), `//registry.npmjs.org/:_authToken=${npmToken}`);

    Show more

    scripts/cli-reporting-install.test.js, line 784

    new RegExp(`^\\[mcp_servers\\.${escaped}\\.env\\]$`, "gm")

    scripts/cli.test.js, line 290

    (twice.match(/^\[mcp_servers\.tencent-rtc-skill-tool\.env\]$/gm) || []).length,

    scripts/publish-npm.js, line 20

    const content = fs.readFileSync(path.resolve(os.homedir(), '.npmrc'), { encoding: 'utf8' });

    skills/trtc/hooks/topic_phase_gate.py, line 41

    ".env",

    skills/trtc/hooks/topic_phase_gate.py, line 42

    ".env.local",

    skills/trtc-ai-oral-coach/capabilities/scenario-roleplay/src/scenario_source.py, line 174

    return bool(os.getenv("KB_DIFY_API_URL")) and bool(os.getenv("KB_DIFY_API_KEY"))

    skills/trtc-ai-oral-coach/capabilities/scenario-roleplay/src/scenario_source.py, line 176

    return bool(os.getenv("KB_COZE_API_KEY"))

    skills/trtc-ai-realtime-interpreter/capabilities/conversation-core/src/credentials.py, line 97

    secret_id=os.getenv("TENCENT_CLOUD_SECRET_ID", ""),

    skills/trtc-ai-realtime-interpreter/capabilities/conversation-core/src/credentials.py, line 98

    secret_key=os.getenv("TENCENT_CLOUD_SECRET_KEY", ""),

    skills/trtc-ai-realtime-interpreter/capabilities/conversation-core/src/credentials.py, line 103

    sdk_secret_key=os.getenv("TRTC_SDK_SECRET_KEY", ""),

    skills/trtc-ai-realtime-interpreter/capabilities/conversation-core/src/credentials.py, line 107

    api_key=os.getenv("LLM_API_KEY", ""),

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Concern

    contains a minified payload.

    OBFUSCATION_MINIFIED_PAYLOAD

    knowledge-base/docs/chat/debug/lib-generate-test-usersig.min.js, line 1

    !function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e=e||self).LibGenerateTestUserSig=t()}(this,

    skills/trtc/room-builder/assets/local-usersig/lib-generate-test-usersig-es.min.js, line 2

    var e="undefined"!=typeof global?global:"undefined"!=typeof self?self:"undefined"!=typeof window?window:{},t=[],r=[],n="undefined"!=typeof Uint8Array?Uint8Array:Array,i=!1;function

    skills/trtc/runtime/sdkappid-resolver-web.cjs, line 1

    var __create = Object.create;

    Show more

    skills/trtc/runtime/telemetry.cjs, line 1

    #!/usr/bin/env node

    skills/trtc/runtime/telemetry.js, line 1

    #!/usr/bin/env node

    skills/trtc-ai-service/auto_adapters/python-backend/fastapi.py.tpl, line 1

    # voice_agent_proxy.py (FastAPI sub-router)

  • Licence

    Pass

    A licence file is present (LICENSE).

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 55a6bcf643ac. can delete files. accepts a host from input, with no fixed list in this file. reads a credential or environment file. contains a minified payload.

Date and source

Date checked:

View source

github.com

Commit graded: 55a6bcf643acb4104105359ed0a1d194bdee7696

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen