Claude Code, Skill
agentskills
Agent skills for Claude Code and other file-reading coding agents
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
SECRETS_PATH_CREDENTIAL
Why this grade
- SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
skills/everjust-odoo-shell-ops/SKILL.md, line 57
cat script.py | ssh -i ~/.ssh/<deploy-key>.pem ubuntu@<box-ip> \
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
skills/white-paper-writing/blastum-docx/scripts/document.py, line 836
shutil.rmtree(self.temp_dir)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach www.googletagmanager.com. The description does not name that host. can reach target.com. The description does not name that host. can reach app.customdomain.ai. The description does not name that host. can reach auth.customdomain.ai. The description does not name that host. can reach registry.modelcontextprotocol.io. The description does not name that host. can reach customdomain.ai. The description does not name that host. can reach a host that is not written as a fixed address. can r
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
skills/ad-transparency-audit/SKILL.md, line 42
curl -s "https://www.googletagmanager.com/gtm.js?id=GTM-XXXXXXX"
skills/ad-transparency-audit/SKILL.md, line 69
curl -s "https://TARGET.com/ads.txt"
skills/agent-discoverability/SKILL.md, line 124
curl -si https://app.customdomain.ai/mcp | grep -i -E 'HTTP/|www-authenticate'
Show more
skills/agent-discoverability/SKILL.md, line 129
curl -s https://app.customdomain.ai/.well-known/oauth-protected-resource | python3 -m json.tool
skills/agent-discoverability/SKILL.md, line 132
curl -s https://auth.customdomain.ai/.well-known/oauth-authorization-server | python3 -m json.tool
skills/agent-discoverability/SKILL.md, line 222
curl -s "https://registry.modelcontextprotocol.io/v0/servers?search=com.customdomain" \
skills/agent-discoverability/SKILL.md, line 227
curl -si https://app.customdomain.ai/mcp | grep -i www-authenticate # must show resource_metadata=...
skills/agent-discoverability/SKILL.md, line 230
curl -s https://customdomain.ai/.well-known/agent/mcp.json | sha256sum
skills/cdp-render-verification/SKILL.md, line 49
=0;i<40;i++){ try{ return (await (await fetch(`http://127.0.0.1:${port}/json/version`)
skills/web-deploy-verification/SKILL.md, line 69
[ "$(curl -s -o /dev/null -w '%{http_code}' http://localhost:3100/ 2>/dev/null)" = "200" ] && break
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL
skills/everjust-odoo-shell-ops/SKILL.md, line 57
cat script.py | ssh -i ~/.ssh/<deploy-key>.pem ubuntu@<box-ip> \
skills/everjust-odoo-shell-ops/SKILL.md, line 81
ssh -i ~/.ssh/<deploy-key>.pem ubuntu@<box-ip> \
skills/everjust-odoo-shell-ops/SKILL.md, line 138
ssh -i ~/.ssh/<deploy-key>.pem ubuntu@<box-ip> 'docker restart deployment-odoo-1'
Show more
skills/everjust-odoo-shell-ops/SKILL.md, line 181
ssh -i ~/.ssh/<deploy-key>.pem ubuntu@<box-ip> \
skills/everjust-odoo-shell-ops/SKILL.md, line 189
rsync -az --rsync-path="sudo rsync" -e "ssh -i ~/.ssh/<deploy-key>.pem" \
skills/everjust-odoo-shell-ops/SKILL.md, line 194
ssh -i ~/.ssh/<deploy-key>.pem ubuntu@<box-ip> '
skills/everjust-odoo-shell-ops/SKILL.md, line 200
ssh -i ~/.ssh/<deploy-key>.pem ubuntu@<box-ip> 'docker restart deployment-odoo-1'
skills/everjust-odoo-shell-ops/SKILL.md, line 227
ssh -i ~/.ssh/<deploy-key>.pem ubuntu@<box-ip> '
skills/godaddy-api/SKILL.md, line 151
self.api_key = api_key or os.getenv("GODADDY_API_KEY", "")
skills/godaddy-api/SKILL.md, line 152
self.api_secret = api_secret or os.getenv("GODADDY_API_SECRET", "")
skills/godaddy-api/SKILL.md, line 311
apiKey = process.env.GODADDY_API_KEY!,
skills/godaddy-api/SKILL.md, line 312
apiSecret = process.env.GODADDY_API_SECRET!,
skills/icp-prospect-list-builder/scripts/producthunt_pull.py, line 26
TOKEN = os.environ.get("PH_TOKEN")
skills/jev-system-one/assets/wrappers/jev.py, line 27
if not FLAG or not os.environ.get("TYPESAFE_API_KEY"):
skills/jev-system-one/assets/wrappers/jev.ts, line 17
if (!FLAG || !process.env.TYPESAFE_API_KEY) return {};
skills/jev-system-one/scripts/jev_batch.py, line 20
KEY = os.environ.get("TYPESAFE_API_KEY", "")
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
the file cap was reached before every file was read.
OBFUSCATION_FILE_CAP_REACHED
skills/white-paper-writing/blastum-notebook/docs/web-testing.md, line 1
# Web Acquisition Testing
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit b85e7f36de48. can delete files. can reach www.googletagmanager.com. The description does not name that host. can reach target.com. The description does not name that host. can reach app.customdomain.ai. The description does not name that host. can reach auth.customdomain.ai. The description does not name that host. can reach registry.modelcontextprotocol.io. The description does not name that host. can reach customdomain.ai. The description does not name that host. can reach a host that is not written as a fixed address. can r reads a credential or environment file. the file cap was reached before every file was read. Grades are a hygiene check, not a se
Date and source
Date checked:
github.com
Commit graded: b85e7f36de4839d8bb7b699675c4dec8f012b19e
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.