Claude Code, Plugin
Chisle
Cut your AI coding agent's token bill on three axes: terse prose, YAGNI-first code, and tool-output compression.
Compatibility: Portable across standard formats.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 0d4bc99c5379.
SECRETS_PATH_CREDENTIAL
Why this grade
- SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
benchmarks/run-live.sh, line 44
cp "$HOME/.claude/.credentials.json" "$ISO/" 2>/dev/null || { echo "no Claude credentials found"; exit 1; }
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
benchmarks/agentic/run.js, line 58
process.on('exit', () => fs.rmSync(ISO, { recursive: true, force: true }));
benchmarks/agentic/run.js, line 166
fs.rmSync(work, { recursive: true, force: true });
benchmarks/agentic/run.js, line 181
fs.rmSync(path.join(repo, '__hidden_test.js'), { force: true });
Show more
benchmarks/agentic/run.js, line 195
fs.rmSync(work, { recursive: true, force: true });
benchmarks/quality/run.js, line 33
process.on('exit', () => fs.rmSync(ISO, { recursive: true, force: true }));
Install and update
Note
The docs document an installer that pipes a download into a shell.
INSTALL_DOCUMENTED_INSTALLER
INSTALL.md, line 36
curl -fsSL https://raw.githubusercontent.com/JayPokale/Chisle/main/install.sh | bash
README.md, line 143
curl -fsSL https://raw.githubusercontent.com/JayPokale/Chisle/main/install.sh | bash
install.sh, line 4
# curl -fsSL https://raw.githubusercontent.com/JayPokale/Chisle/main/install.sh | bash
Show more
site/src/components/GetStarted.tsx, line 20
cmd: "curl -fsSL https://raw.githubusercontent.com/JayPokale/Chisle/main/install.sh | bash",
Network
Concern
can reach a host that is not written as a fixed address. can reach registry.npmjs.org. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
benchmarks/results/raw-backfires/debounce__cur__1.json, line 9
"answer": "No existing code found. Here's a debounced search input using React hooks:\n\n```jsx\nimport { useState, useRef, useCallback } from 'react';\n\nfunction SearchInput() {\
benchmarks/results/raw-backfires/debounce__cur__3.json, line 9
"answer": "I need to see your current search input code to add debounce. What framework are you using (React, Vue, vanilla JS), and can you share the component/function that handle
benchmarks/results/raw-backfires/debounce__fix__1.json, line 9
"answer": "No existing code found. Here are two approaches:\n\n**Vanilla JS with debounce helper:**\n\n```javascript\nfunction debounce(fn, delay) {\n let timeoutId;\n return fun
Show more
benchmarks/results/raw-backfires/debounce__fix__3.json, line 9
"answer": "No existing file, so here are the main patterns:\n\n**React (custom hook):**\n```javascript\nfunction useDebounce(value, delay) {\n const [debouncedValue, setDebouncedV
benchmarks/results/raw-backfires/debounce__vanilla__1.json, line 9
"answer": "I'd be happy to help! To give you the most relevant code, I need to know:\n\n1. **What framework/language?** (React, Vue, vanilla JavaScript, etc.)\n2. **Do you have exi
benchmarks/results/raw-backfires/debounce__vanilla__2.json, line 9
"answer": "I'll show you a React example with debounce, since that's the most common pattern. Here are the main approaches:\n\n## 1. Using a custom hook (recommended)\n\n```javascr
benchmarks/results/raw-backfires/debounce__vanilla__3.json, line 9
"answer": "No existing code found. I'll show you debounce patterns for the most common frameworks. Which are you using?\n\n**React with hooks:**\n```javascript\nimport { useState,
benchmarks/results/raw-oct-notools/default-s1/debounce__chisle.json, line 1
{"duration_api_ms":6268,"stop_reason":"end_turn","session_id":"2477c391-411d-41c6-a4a1-31734898e8ca","total_cost_usd":0.018587,"usage":{"input_tokens":10,"cache_creation_input_toke
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_CREDENTIAL
benchmarks/run-live.sh, line 44
cp "$HOME/.claude/.credentials.json" "$ISO/" 2>/dev/null || { echo "no Claude credentials found"; exit 1; }
benchmarks/agentic/run.js, line 40
fs.copyFileSync(path.join(os.homedir(), '.claude', '.credentials.json'), path.join(ISO, '.credentials.json'));
benchmarks/agentic/run.js, line 115
fs.copyFileSync(path.join(ISO, '.credentials.json'), path.join(cfg, '.credentials.json'));
Show more
benchmarks/quality/run.js, line 28
fs.copyFileSync(path.join(os.homedir(), '.claude', '.credentials.json'), path.join(ISO, '.credentials.json'));
benchmarks/results/raw-backfires/run.js, line 11
fs.copyFileSync(path.join(os.homedir(), '.claude', '.credentials.json'), path.join(ISO, '.credentials.json'));
benchmarks/results/raw-prompt-compression/run.js, line 11
fs.copyFileSync(path.join(os.homedir(), '.claude', '.credentials.json'), path.join(ISO, '.credentials.json'));
benchmarks/results/raw-trim/run.js, line 12
fs.copyFileSync(path.join(os.homedir(), '.claude', '.credentials.json'), path.join(ISO, '.credentials.json'));
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains an encoded blob in a file that should be readable.
OBFUSCATION_ENCODED_BLOB
benchmarks/quality/raw/code__longestsub__vanilla__1.json, line 1
{"duration_api_ms":6383,"stop_reason":"end_turn","session_id":"782b00a6-073f-4c54-a0d4-f1707733346b","total_cost_usd":0.010984199999999998,"usage":{"input_tokens":10,"cache_creatio
benchmarks/results/raw-pi/auth-bug__caveman.jsonl, line 145
{"type":"message_end","message":{"role":"assistant","content":[{"type":"thinking","thinking":"**Analyzing JWT expiration boundary behavior**\n\n**Identifying unit mismatch causing
benchmarks/results/raw-pi/auth-bug__caveman.jsonl, line 146
{"type":"turn_end","message":{"role":"assistant","content":[{"type":"thinking","thinking":"**Analyzing JWT expiration boundary behavior**\n\n**Identifying unit mismatch causing tok
Show more
benchmarks/results/raw-pi/auth-bug__caveman.jsonl, line 147
{"type":"agent_end","messages":[{"role":"user","content":[{"type":"text","text":"Our auth middleware rejects valid tokens at the exact expiry boundary (it uses currentTime > expiry
benchmarks/results/raw-pi/auth-bug__vanilla.jsonl, line 302
{"type":"message_end","message":{"role":"assistant","content":[{"type":"thinking","thinking":"**Explaining need for file access**","thinkingSignature":"{\"id\":\"rs_0ebfe7b8c0fca0c
benchmarks/results/raw-pi/auth-bug__vanilla.jsonl, line 303
{"type":"turn_end","message":{"role":"assistant","content":[{"type":"thinking","thinking":"**Explaining need for file access**","thinkingSignature":"{\"id\":\"rs_0ebfe7b8c0fca0c701
benchmarks/results/raw-pi/auth-bug__vanilla.jsonl, line 304
{"type":"agent_end","messages":[{"role":"user","content":[{"type":"text","text":"Our auth middleware rejects valid tokens at the exact expiry boundary (it uses currentTime > expiry
benchmarks/results/raw-pi/cache__ponytail.jsonl, line 109
{"type":"message_end","message":{"role":"assistant","content":[{"type":"thinking","thinking":"**Drafting minimal Python caching example**\n\n**Finalizing cache invalidation example
benchmarks/results/raw-pi/cache__ponytail.jsonl, line 110
{"type":"turn_end","message":{"role":"assistant","content":[{"type":"thinking","thinking":"**Drafting minimal Python caching example**\n\n**Finalizing cache invalidation example**"
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 0d4bc99c5379. can delete files. can reach a host that is not written as a fixed address. can reach registry.npmjs.org. The description does not name that host. reads a credential or environment file. contains an encoded blob in a file that should be readable.
Date and source
Date checked:
github.com
Commit graded: 0d4bc99c5379e2996a72338282f23ec8cdfab304
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.