Claude Code, Plugin
Ai Plugin
Cross-agent skills: skill authoring, DeepSeek Harness (dsh) plugin development, Claude Code plugin development, and DeepSeek model cost routing.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
OBFUSCATION_MINIFIED_PAYLOAD
Why this grade
- OBFUSCATION_MINIFIED_PAYLOAD Medium
Contains a very long line with almost no spaces in a script or style file.
dsh-plugin/lib/client.js, line 39
const css = ".apxdsh-root{display:flex;flex-direction:column;gap:24px;width:100%;max-width:1600px;margin:0 auto;min-width:0;color:var(--dsw-alias-label-primary);font-size:14px;line
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
sidecars/zvec_sidecar.py, line 137
subprocess.run(
sidecars/zvec_sidecar.py, line 234
shutil.rmtree(os.path.dirname(previous), ignore_errors=True)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address. can reach api.deepseek.com. The description does not name that host. can reach api.github.com. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
dsh-plugin/lib/client.js, line 145
response = await fetch(BRIDGE_BASE + path, {
dsh-plugin/lib/client.js, line 1544
const r = await fetch("/aipx-hub/optimize", {
dsh-plugin/lib/hub-bridge.js, line 441
const callCompletion = (modelName) => fetch('https://api.deepseek.com/chat/completions', {
Show more
dsh-plugin/lib/hub/http-downstream.js, line 44
res = await fetch(this.def.url, {
dsh-plugin/lib/hub/install-source.js, line 225
const res = await fetch(url, {
dsh-plugin/skills/deepseek-migration/SKILL.md, line 56
curl https://api.deepseek.com/chat/completions \
scripts/registry-smoke.mjs, line 40
const r = await fetch(`https://api.github.com/repos/${repo}/contents/package.json`, {
scripts/validate-registry.mjs, line 98
const res = await fetch(`https://api.github.com/repos/${entry.repo}`, { headers })
Secrets
Note
reads an environment variable.
SECRETS_ENV_READ
dsh-plugin/lib/hub-bridge.js, line 469
if (process.env.DEEPSEEK_API_KEY) return process.env.DEEPSEEK_API_KEY
dsh-plugin/lib/hub/install-source.js, line 224
const token = process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN
scripts/registry-smoke.mjs, line 39
if (process.env.GITHUB_TOKEN) headers.Authorization = `Bearer ${process.env.GITHUB_TOKEN}`
Show more
scripts/registry-smoke.mjs, line 67
env: { ...process.env, AIPX_CONFIG_DIR: configDir, GITHUB_TOKEN: process.env.GITHUB_TOKEN ?? '' },
scripts/validate-registry.mjs, line 93
const token = process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN
sidecars/zvec_sidecar.py, line 186
api_key = os.environ.get("AIPX_EMBEDDING_API_KEY")
src/doctor.js, line 59
const has = Boolean(process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN)
src/github.js, line 15
const token = process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains a minified payload.
OBFUSCATION_MINIFIED_PAYLOAD
dsh-plugin/lib/client.js, line 39
const css = ".apxdsh-root{display:flex;flex-direction:column;gap:24px;width:100%;max-width:1600px;margin:0 auto;min-width:0;color:var(--dsw-alias-label-primary);font-size:14px;line
dsh-plugin/lib/client.js, line 53
const cssAdd = ".apxdsh-switchRow{display:flex;flex-direction:row;align-items:center;gap:10px;width:100%;padding:8px 12px;border:.5px solid var(--dsw-alias-border-l4);border-radius
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 8fe844594a25. can delete files. can reach a host that is not written as a fixed address. can reach api.deepseek.com. The description does not name that host. can reach api.github.com. The description does not name that host. reads an environment variable. contains a minified payload.
Date and source
Date checked:
github.com
Commit graded: 8fe844594a2540d219fb7200717715fccc2b730c
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.