Claude Code, Plugin
arcgram
arcgram has PlugVet grade C (One medium finding) from our automated hygiene checks. Finding: contains a very long line with almost no spaces in a script or style file. This is a hygiene check, not a security audit or a guarantee. Graded on 16/10/2026.
Arcgram — an interactive diagram engine for human, AI collaboration: an AI agent draws its reasoning as an auditable node-and-edge flow and self-audits it, delivered as one standalone HTML file.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 147fda7a6225, unchanged since the check below.
OBFUSCATION_MINIFIED_PAYLOAD
Why this grade
- OBFUSCATION_MINIFIED_PAYLOAD Medium
Contains a very long line with almost no spaces in a script or style file.
template-v2.html, line 1
<!DOCTYPE html>
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
skills/gates/scanners/v2-public-gates.mjs, line 83
process.on('exit', () => { try { fs.rmSync(tmp, { recursive: true, force: true }); } catch { } });
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
USAGE.md, line 21
fetch(ENGINE).then(r => r.text()).then(t => {
Secrets
Pass
No read of a credential file or secret environment variable found.
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains a minified payload.
OBFUSCATION_MINIFIED_PAYLOAD
template-v2.html, line 1
<!DOCTYPE html>
examples/example-audit.html, line 1
<!DOCTYPE html>
examples/example-bands.html, line 1
<!DOCTYPE html>
Show more
examples/example-harness.html, line 1
<!DOCTYPE html>
examples/example-thinkflow.html, line 1
<!DOCTYPE html>
examples/example-workflow-H.html, line 1
<!DOCTYPE html>
examples/example-workflow.html, line 1
<!DOCTYPE html>
examples/example.html, line 1
<!DOCTYPE html>
skills/gates/scanners/label-fit-scan.mjs, line 15
const W10 = [2.930,3.228,4.893,6.416,6.416,9.370,7.231,3.086,3.936,3.936,4.834,6.416,3.086,4.834,3.086,3.164,6.416,4.756,6.152,6.387,6.553,6.299,6.484,5.811,6.504,6.484,3.086,3.086
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 147fda7a6225. can delete files. can reach a host that is not written as a fixed address. contains a minified payload.
Date and source
Date checked:
github.com
Commit graded: 147fda7a6225ce2757c84dbeff97273c76ccc68b
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.