Claude Code, Skill
Cc Thinking Skills
28 eval-informed mental models and critical-thinking skills for Claude Code, GitHub Copilot, Codex, Cursor, and other Agent Skills-compatible tools
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 7b8fece345df, unchanged since the check below.
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED OBFUSCATION_FILE_OVER_READ_CAP
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
evals/lib/droid.js, line 157
try { fs.unlinkSync(promptFile); } catch (_) { /* ignore */ } - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
evals/datasets/ingest-hf.js, line 152
if (r.status !== 0) throw new Error('curl failed: ' + r.stderr); - SECRETS_PATH_UNCONFIRMED Low
The Secrets check reports a credential or environment file, but no quoted line shows a recognisable path.
evals/datasets/calibrated/debugging-fault-localization-candidate-pool.jsonl, line 150
{"id": "swebench-249", "original_id": "swebench-249", "prompt": "Repository: pallets/flask\n\nGitHub issue:\nFlask routes to return domain/sub-domains information\nCurrently when c - OBFUSCATION_FILE_OVER_READ_CAP Note
A file was over the read cap and was not fully read.
evals/datasets/calibrated/conceptual-reframes-decisive.jsonl, line 1
{"id": "first-principles-01", "original_id": "first-principles-01", "prompt": "A distributed system team says they cannot have both strong consistency and 100% availability during
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
evals/lib/droid.js, line 157
try { fs.unlinkSync(promptFile); } catch (_) { /* ignore */ }
evals/lib/io.js, line 44
try { fs.unlinkSync(tmp); } catch (_) { /* ignore */ }
evals/datasets/authored/challenging-red-team.jsonl, line 5
{"id":"crw-rt-05","mode":"binary-decision","prompt":"A backup microservice lets an operator tag each archive with a short label. The label is validated and then used to name the ou
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
evals/datasets/ingest-hf.js, line 152
if (r.status !== 0) throw new Error('curl failed: ' + r.stderr);
evals/datasets/authored/challenging-red-team.jsonl, line 4
{"id":"crw-rt-04","mode":"binary-decision","prompt":"An avatar-import feature fetches an image from a user-supplied URL. A penetration tester files it as a high-severity SSRF: \"Th
evals/datasets/authored/theory-of-constraints-bottleneck.jsonl, line 9
{"id":"toc-09","mode":"binary-decision","prompt":"A web scraping pipeline processes URLs through: DNS resolution (15ms), TCP connect (20ms), TLS handshake (25ms), HTTP fetch (1,800
Show more
evals/datasets/calibrated/systems-product-strategy-pairwise-candidate-pool.jsonl, line 9
{"id": "toc-09", "original_id": "toc-09", "prompt": "A web scraping pipeline processes URLs through: DNS resolution (15ms), TCP connect (20ms), TLS handshake (25ms), HTTP fetch (1,
evals/datasets/calibrated/systems-product-strategy-pairwise-decisive.jsonl, line 6
{"id": "toc-09", "original_id": "toc-09", "prompt": "A web scraping pipeline processes URLs through: DNS resolution (15ms), TCP connect (20ms), TLS handshake (25ms), HTTP fetch (1,
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_UNCONFIRMED
evals/datasets/calibrated/debugging-fault-localization-candidate-pool.jsonl, line 150
{"id": "swebench-249", "original_id": "swebench-249", "prompt": "Repository: pallets/flask\n\nGitHub issue:\nFlask routes to return domain/sub-domains information\nCurrently when c
evals/datasets/calibrated/debugging-fault-localization-decisive.jsonl, line 150
{"id": "swebench-249", "original_id": "swebench-249", "prompt": "Repository: pallets/flask\n\nGitHub issue:\nFlask routes to return domain/sub-domains information\nCurrently when c
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read.
OBFUSCATION_FILE_OVER_READ_CAP
evals/datasets/calibrated/conceptual-reframes-decisive.jsonl, line 1
{"id": "first-principles-01", "original_id": "first-principles-01", "prompt": "A distributed system team says they cannot have both strong consistency and 100% availability during
evals/datasets/calibrated/debugging-fault-localization-candidate-pool.jsonl, line 1
{"id": "swebench-0", "original_id": "swebench-0", "prompt": "Repository: astropy/astropy\n\nGitHub issue:\nModeling's `separability_matrix` does not compute separability correctly
evals/datasets/calibrated/debugging-fault-localization-decisive.jsonl, line 1
{"id": "swebench-0", "original_id": "swebench-0", "prompt": "Repository: astropy/astropy\n\nGitHub issue:\nModeling's `separability_matrix` does not compute separability correctly
Show more
evals/datasets/calibrated/quantitative-uncertainty-candidate-pool.jsonl, line 1
{"id": "bayes-1", "original_id": "bayes-1", "prompt": "A disease affects 1% of a screened population. A diagnostic test correctly flags 90% of people who truly have the disease, an
evals/results/wf-confirm-behavioral/workflow-vs-skill.json, line 1
{
evals/results/wf-confirm-haiku/workflow-objective.json, line 1
{
evals/results/wf-confirm-opus/workflow-objective.json, line 1
{
evals/results/wf-confirm-sonnet/workflow-objective.json, line 1
{
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 7b8fece345df. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read.
Date and source
Date checked:
github.com
Commit graded: 7b8fece345dfaa11773be7152ccd194589cb5437
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.