Claude Code, Skill
Ai Toolkit
Agent skills for deep code review and grounded investigation in PHP, TypeScript, Python and beyond, plus dedicated Laravel and React packs.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
NETWORK_HOST_FROM_INPUT
Why this grade
- NETWORK_HOST_FROM_INPUT Medium
A file takes a URL or endpoint as input and has no fixed host list.
inertia-react/skills/laravel-inertia-react/rules/form-file-uploads.md, line 24
await fetch('/upload', {
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Note
requests shell access. The manifest names this permission.
PERMISSION_SHELL_DECLARED
review/skills/comment-audit/scripts/python-comment-lines.py, line 72
output = subprocess.run( # fixed argv, no shell; git is meant to come from PATH # nosec B603 B607
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address. accepts a host from input, with no fixed list in this file. can reach api.stripe.com. The description does not name that host.
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
inertia-react/skills/laravel-inertia-react/rules/form-file-uploads.md, line 24
await fetch('/upload', {
inertia-react/skills/laravel-inertia-react/rules/nav-programmatic.md, line 27
const response = await fetch('/api/users', {
inertia-react/skills/laravel-inertia-react/rules/page-partial-reloads.md, line 36
const response = await fetch('/api/notifications');
Show more
inertia-react/skills/laravel-inertia-react/rules/shared-app-config.md, line 29
fetch('/api/config').then(res => res.json()).then(setConfig);
inertia-react/skills/laravel-inertia-react/rules/shared-auth-user.md, line 22
fetch('/api/user')
inertia-react/skills/react-vite-best-practices/AGENTS.md, line 3031
const response = await fetch('https://api.stripe.com/v1/charges', {
inertia-react/skills/react-vite-best-practices/AGENTS.md, line 3070
const response = await fetch(`${import.meta.env.VITE_API_URL}/payments/charge`, {
inertia-react/skills/react-vite-best-practices/rules/env-sensitive-data.md, line 27
const response = await fetch('https://api.stripe.com/v1/charges', {
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
inertia-react/skills/react-vite-best-practices/AGENTS.md, line 486
authToken: process.env.SENTRY_AUTH_TOKEN,
inertia-react/skills/react-vite-best-practices/AGENTS.md, line 2809
# ❌ Bad: .env
inertia-react/skills/react-vite-best-practices/AGENTS.md, line 2837
# ✅ Good: .env
Show more
inertia-react/skills/react-vite-best-practices/AGENTS.md, line 2879
# .env.development
inertia-react/skills/react-vite-best-practices/AGENTS.md, line 2882
# .env.production
inertia-react/skills/react-vite-best-practices/AGENTS.md, line 2885
# .env.staging
inertia-react/skills/react-vite-best-practices/AGENTS.md, line 2930
# ❌ Bad - single .env with everything
inertia-react/skills/react-vite-best-practices/AGENTS.md, line 2931
# .env
inertia-react/skills/react-vite-best-practices/AGENTS.md, line 2947
# .env - shared defaults loaded in ALL modes
inertia-react/skills/react-vite-best-practices/rules/build-sourcemaps.md, line 82
authToken: process.env.SENTRY_AUTH_TOKEN,
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains an encoded blob in a file that should be readable.
OBFUSCATION_ENCODED_BLOB
package-lock.json, line 1
{
inertia-react/skills/tailwind-best-practices/rules/component-form-elements.md, line 94
bg-[url('data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMjAiIGhlaWdodD0iMjAiIHZpZXdCb3g9IjAgMCAyMCAyMCIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj48cGF0aCBkPSJNNSA3L
laravel/skills/php-best-practices/rules/sec-file-uploads.md, line 1
---
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit f3e89a3f7708. requests shell access. The manifest names this permission. can reach a host that is not written as a fixed address. accepts a host from input, with no fixed list in this file. can reach api.stripe.com. The description does not name that host. reads a credential or environment file. contains an encoded blob in a file that should be readable.
Date and source
Date checked:
github.com
Commit graded: f3e89a3f77083515269641075eb80b0498b415ab
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.