Claude Code, Skill
Claude Capability Bridge Skill
Use when running as a third-party or non-default model inside Claude Code, Claude desktop/web, or any Claude-compatible host and the task needs real capabilities - files and git, shell and builds, browsers and web apps, MCP connectors, artifact delivery, GUI control, delegation,
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 0e2d0f77de45, unchanged since the check below.
PERMISSION_DELETE_FILES SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
scripts/validate_skill.py, line 377
for banned in ("eval(", "exec(", "os.system(", "shell=True"): - SECRETS_PATH_DOTENV Low
Mentions a .env file.
references/projects-and-files.md, line 61
Environment configuration can exist in `.env`, shell variables, secret stores, or host settings. Never dump the whole environment to chat. Inspect variable names and only the minim - OBFUSCATION_ENCODED_BLOB Low
Contains a long base64 shaped string in a file that should be readable.
assets/banner-hero-dark.svg, line 1
<svg viewBox="0 0 1200 300" xmlns="http://www.w3.org/2000/svg" xmlns:c2pa="http://c2pa.org/manifest"><metadata><c2pa:manifest>AAAWgmp1bWIAAAAeanVtZGMycGEAEQAQgAAAqgA4m3EDYzJwYQAAAB
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
scripts/validate_skill.py, line 377
for banned in ("eval(", "exec(", "os.system(", "shell=True"):
scripts/validate_skill.py, line 390
proc = subprocess.run(
scripts/validate_skill.py, line 413
if _uses_command(text, r"\b(?:Invoke-Expression|iex)\b"):
Show more
scripts/validate_skill.py, line 442
proc = subprocess.run(
scripts/bridgelib/payload.py, line 75
shutil.rmtree(out)
docs/baseline-audit.md, line 27
* `subprocess.run` in `scripts/validate_skill.py` is used for `bash -n` syntax
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Pass
No network call found.
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
references/projects-and-files.md, line 61
Environment configuration can exist in `.env`, shell variables, secret stores, or host settings. Never dump the whole environment to chat. Inspect variable names and only the minim
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains an encoded blob in a file that should be readable.
OBFUSCATION_ENCODED_BLOB
assets/banner-hero-dark.svg, line 1
<svg viewBox="0 0 1200 300" xmlns="http://www.w3.org/2000/svg" xmlns:c2pa="http://c2pa.org/manifest"><metadata><c2pa:manifest>AAAWgmp1bWIAAAAeanVtZGMycGEAEQAQgAAAqgA4m3EDYzJwYQAAAB
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 0e2d0f77de45. can delete files. reads a credential or environment file. contains an encoded blob in a file that should be readable.
Date and source
Date checked:
github.com
Commit graded: 0e2d0f77de450e024a12561f183a7cc47864b3d7
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.