Claude Code, Skill
beagle
Image: NASA, Public Domain.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit d1a74899fbfe, unchanged since the check below.
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV SECRETS_ENV_READ OBFUSCATION_FILE_CAP_REACHED
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
plugins/beagle-python/skills/pytest-code-review/references/fixtures.md, line 69
os.remove(file_path) - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
plugins/beagle-ai/skills/langgraph-code-review/SKILL.md, line 225
result = requests.get(url) # Blocks event loop! - NETWORK_UNNAMED_HOST Low
Calls a fixed host that the description does not name.
plugins/beagle-ai/skills/langgraph-code-review/SKILL.md, line 225
result = requests.get(url) # Blocks event loop! - SECRETS_PATH_DOTENV Low
Mentions a .env file.
plugins/beagle-docs/skills/improve-doc/SKILL.md, line 233
> cp .env.example .env - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
plugins/beagle-go/skills/go-architect/SKILL.md, line 229
apiKey := os.Getenv("SENDGRID_API_KEY") // don't do this - OBFUSCATION_FILE_CAP_REACHED Note
The 400 file cap was reached before every file was read.
plugins/beagle-react/skills/remix-v2-forms-review/references/form-vs-fetcher.md, line 1
# Form vs Fetcher Misuse
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
plugins/beagle-python/skills/pytest-code-review/references/fixtures.md, line 69
os.remove(file_path)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address. can reach api.example.com. The description does not name that host. can reach api.weather.com. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
plugins/beagle-ai/skills/langgraph-code-review/SKILL.md, line 225
result = requests.get(url) # Blocks event loop!
plugins/beagle-ai/skills/pydantic-ai-testing/SKILL.md, line 220
return await ctx.deps.api.fetch()
plugins/beagle-analysis/skills/resolve-beagle/references/subagent-prompts.md, line 76
Your job: use web search and page fetch (if web access is available) to find auth
Show more
plugins/beagle-core/skills/llm-artifacts-detection/references/abstraction-criteria.md, line 53
def fetch(self, url: str) -> bytes: ...
plugins/beagle-core/skills/llm-artifacts-detection/references/abstraction-criteria.md, line 56
def fetch(self, url: str) -> bytes:
plugins/beagle-core/skills/llm-artifacts-detection/references/abstraction-criteria.md, line 57
return requests.get(url).content
plugins/beagle-elixir/skills/elixir-code-review/references/documentation.md, line 79
@spec fetch(id()) :: result()
plugins/beagle-elixir/skills/elixir-performance-review/references/genserver-bottlenecks.md, line 120
def fetch(pid) do
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
plugins/beagle-docs/skills/improve-doc/SKILL.md, line 233
> cp .env.example .env
plugins/beagle-go/skills/go-architect/SKILL.md, line 229
apiKey := os.Getenv("SENDGRID_API_KEY") // don't do this
plugins/beagle-go/skills/go-architect/references/dependency-injection.md, line 365
apiKey := os.Getenv("SENDGRID_API_KEY")
Show more
plugins/beagle-go/skills/wish-ssh-code-review/references/sessions.md, line 96
return password == os.Getenv("SSH_PASSWORD")
.gitignore, line 21
*.py[cod]
.gitignore, line 41
*secret*
.gitignore, line 43
!.env.example
plugins/beagle-analysis/skills/artifact-analysis/references/skip-patterns.md, line 11
- `.env`, `.env.*`
plugins/beagle-analysis/skills/artifact-analysis/references/skip-patterns.md, line 46
- **Case-insensitive extension matching.** `.ENV` is skipped just like `.env`.
plugins/beagle-analysis/skills/artifact-analysis/references/skip-patterns.md, line 49
- **Sensitive list is non-overridable.** `.env`, `*.pem`, `*.key`, and credential files are always skipped even when explicitly passed. If a caller needs those contents, they paste
plugins/beagle-react/skills/remix-v2-meta-sessions-review/SKILL.md, line 37
- [ ] `secrets` is read from `process.env` (no hardcoded strings, no committed `.env.example` values)
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
the file cap was reached before every file was read.
OBFUSCATION_FILE_CAP_REACHED
plugins/beagle-react/skills/remix-v2-forms-review/references/form-vs-fetcher.md, line 1
# Form vs Fetcher Misuse
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit d1a74899fbfe. can delete files. can reach a host that is not written as a fixed address. can reach api.example.com. The description does not name that host. can reach api.weather.com. The description does not name that host. reads a credential or environment file. the file cap was reached before every file was read.
Date and source
Date checked:
github.com
Commit graded: d1a74899fbfec74974d1818e4cac7c3d54d44b65
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.