Grades are a hygiene check, not a security guarantee.

Claude Code, Skill

Ai Os

一个会生长的 Agent 工作环境。

Compatibility: Not stated.

Grade B

Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

SECRETS_PATH_DOTENV PERMISSION_SHELL_DECLARED

Why this grade

  • SECRETS_PATH_DOTENV Low

    Mentions a .env file.

    .gitignore, line 2 .env

  • PERMISSION_SHELL_DECLARED Note

    Runs shell commands, and the manifest or description says so.

    tools/experience_push.py, line 269 out = subprocess.check_output(

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Note

    requests shell access. The manifest names this permission.

    PERMISSION_SHELL_DECLARED

    tools/experience_push.py, line 269

    out = subprocess.check_output(

    tools/wrapup_sync.py, line 46

    r = subprocess.run(["git"] + cmd, cwd=cwd, capture_output=True, text=True, encoding="utf-8", errors="replace")

  • Install and update

    Pass

    No install-time script found, and dependencies are pinned or absent.

  • Network

    Pass

    No network call found.

  • Secrets

    Concern

    reads a credential or environment file.

    SECRETS_PATH_DOTENV

    .gitignore, line 1

    # 环境 / 密钥

    .gitignore, line 2

    .env

    AI-OS_SUCCESS_LOG.md, line 1228

    `DSH_AGENTS_HOME` 与 root `.env` 配置路径、browser-control skill（V2 无此运行时）、

    Show more

    domains/ai-os/patterns/browser_gif_evidence.md, line 140

    storage），持久化客户端状态不得影响证据。API key 走应用正常配置路径（root `.env`），永不回显。

    domains/ai-os/patterns/browser_gif_evidence.md, line 206

    环境变量与 root `.env` 具体配置路径、`browser-control` skill（V2 无此运行时 - - 映射为仓库声明的

    evolution/README.md, line 188

    `DSH_AGENTS_HOME` 与 root `.env` 配置路径、browser-control skill（V2 无此运行时 - - 映射仓库

    evolution/decisions.md, line 701

    （`pnpm run build && pnpm run build:web`、`DSH_HOME`/`DSH_AGENTS_HOME` 与 root `.env` 配置路径、

    evolution/intake/record-browser-gif/SKILL.md, line 30

    2. Boot one server per port from that tree with fresh scratch `DSH_HOME`, `DSH_AGENTS_HOME`, workspace, and session state. Give the browser a fresh isolated context or profile as w

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Pass

    No encoded or minified payload found.

  • Licence

    Pass

    A licence file is present (LICENSE).

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit d053690f6d5d. requests shell access. The manifest names this permission. reads a credential or environment file.

Date and source

Date checked:

View source

github.com

Commit graded: d053690f6d5d57d33cefd1af5faf90792340462a

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen