Claude Code, Skill
Awesome Skills
Independent Agent Skills packaged according to the Anthropic Agent Skills specification.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit a5d5e22e5016.
SECRETS_PATH_CREDENTIAL
Why this grade
- SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
muse-reverse-ssh/SKILL.md, line 125
install -m 600 tunnel-key ~/.ssh/tunnel-key
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Note
requests shell access. The manifest names this permission.
PERMISSION_SHELL_DECLARED
best-project-memory/scripts/snapshot_state.py, line 39
result = subprocess.run(
best-project-memory/scripts/snapshot_state.py, line 55
result = subprocess.run(
production-code-quality-review/scripts/review_skill_lib.py, line 14
result = subprocess.run(
Show more
production-code-quality-review/scripts/review_skill_lib.py, line 25
result = subprocess.run(
split-image-assets/scripts/apply_candidate_promotion_decision.py, line 12
result = subprocess.run(
split-image-assets/scripts/apply_candidate_selection_decision.py, line 9
result = subprocess.run(
split-image-assets/scripts/record_candidate_promotion_approval.py, line 158
result = subprocess.run(
split-image-assets/scripts/record_candidate_selection.py, line 116
result = subprocess.run(
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
cloudphone-adb-tunnel/SKILL.md, line 54
curl -fsSL <你的脚本URL> -o ~/install-termux.sh && bash ~/install-termux.sh
cloudphone-adb-tunnel/scripts/install-termux.sh, line 89
len=$(curl -sIL --connect-timeout 8 "$1" | tr -d '\r' | awk 'tolower($1)=="content-length:"{s=$2} END{print s}')
cloudphone-adb-tunnel/scripts/install-termux.sh, line 91
curl -fsSL --connect-timeout 8 --retry 1 --speed-limit 1024 --speed-time 15 -o "$2" "$1" & local pid=$!
Show more
cloudphone-adb-tunnel/scripts/install-termux.sh, line 107
fetch() { # $1="名称|URL|模式"
cloudphone-adb-tunnel/scripts/install-termux.sh, line 131
command -v curl >/dev/null 2>&1 && curl --version >/dev/null 2>&1 || NEED="$NEED openssl libcurl curl"
cloudphone-adb-tunnel/scripts/install-termux.sh, line 148
curl --version >/dev/null 2>&1 && ok "curl 就绪 ($(curl --version 2>/dev/null | head -1 | awk '{print $1,$2}'))" || die "curl 仍损坏：手动 apt update && apt full-upgrade 后重跑"
grok-search/scripts/lib/direct.js, line 22
const response = await fetch(url, {
grok-search/scripts/lib/direct.js, line 401
const response = await fetch(url, {
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_CREDENTIAL
muse-reverse-ssh/SKILL.md, line 125
install -m 600 tunnel-key ~/.ssh/tunnel-key
muse-reverse-ssh/scripts/reverse-ssh-keepalive.sh, line 267
# ~/.ssh/known_hosts instead. Never use these options for the operator access
cue-sandbox/SKILL.md, line 45
- 有 `ssh mesh-cue` / `~/.ssh/cue-access-key` → **你在操作者本机**。写 SSH config、装访问钥，不要在本机起 EasyTier 当 Cue。
Show more
cue-sandbox/SKILL.md, line 73
3. **两把钥。** 访问钥只在操作者本机，公钥只装 Cue 登录用户。隧道钥只在 Cue，公钥只装印度 `<INDIA_USER>`。不要用 `id_rsa` 当隧道钥，不要在印度建 `ubuntu`，不要把访问钥放到任何 VPS。
cue-sandbox/references/ssh.md, line 13
操作者本机 `~/.ssh/config`：
cue-sandbox/references/ssh.md, line 19
IdentityFile ~/.ssh/cue-access-key
cue-sandbox/references/ssh.md, line 29
IdentityFile ~/.ssh/cue-access-key
cue-sandbox/references/ssh.md, line 36
每条 Host 必须显式 `IdentityFile` + `IdentitiesOnly yes`。不要依赖默认 `id_rsa`。
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
the file cap was reached before every file was read.
OBFUSCATION_FILE_CAP_REACHED
split-image-assets/tests/test_docs_and_contract.py, line 1
import pathlib
Licence
Note
no licence file found.
LICENCE_MISSING
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit a5d5e22e5016. requests shell access. The manifest names this permission. can reach a host that is not written as a fixed address. reads a credential or environment file. the file cap was reached before every file was read. no licence file found.
Date and source
Date checked:
github.com
Commit graded: a5d5e22e5016455f0285f7132e8d276492472593
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.