Claude Code, Plugin
Claude Plugins
Peter Forret's Claude Code plugins.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
PERMISSION_SHELL_UNDECLARED
Why this grade
- PERMISSION_SHELL_UNDECLARED Medium
Runs shell commands that the manifest or description does not mention.
plugins/fodo/dashboard/index.php, line 679
$proc = @proc_open([$bin, 'agents', '--json', '--all'], [0 => ['file', '/dev/null', 'r'], 1 => ['pipe', 'w'], 2 => ['pipe', 'w']], $pipes);
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
requests shell access. No manifest field names shell or command execution.
PERMISSION_SHELL_UNDECLARED
plugins/fodo/dashboard/index.php, line 679
$proc = @proc_open([$bin, 'agents', '--json', '--all'], [0 => ['file', '/dev/null', 'r'], 1 => ['pipe', 'w'], 2 => ['pipe', 'w']], $pipes);
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
plugins/fodo/scripts/web.sh, line 49
# something else already answers on this port: our php could not bind, and curl below would get the other server's reply
plugins/fodo/scripts/web.sh, line 50
if curl -s -o /dev/null --max-time 2 "$(url "$port")"; then
plugins/fodo/scripts/web.sh, line 59
if ! curl -s -o /dev/null --retry 10 --retry-connrefused --retry-delay 1 "$(url "$port")" || [ -z "$(running_pid)" ]; then
Show more
docs/publishing.md, line 152
Then it was the `fetch()` of the 15-second partial refresh, now replaced by
docs/todo/done/2026-10-22.feature.todo-claude-plugin.md, line 547
info item). The credential hold now pointed at the `fetch()` of the 15 s partial refresh. User chose a
docs/todo/done/2026-10-22.feature.todo-claude-plugin.md, line 552
- Re-validate on `main @ 0899cf7`: the fetch() is gone; the credential hold's "send" side moved to
docs/todo/done/2026-10-22.feature.todo-claude-plugin.md, line 558
is the fourth false positive in a row (http:// → fetch() → `${x:-$y}` → `IFS=$'\t'`). We stopped chasing it:
docs/todo/done/2026-10-22.feature.todo-claude-plugin.md, line 592
label); PNG icons and `manifest.json` dropped (SVG only, no PWA install); the 15 s fetch() refresh became a
Secrets
Pass
No read of a credential file or secret environment variable found.
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 45ed6d913765. requests shell access. No manifest field names shell or command execution. can reach a host that is not written as a fixed address.
Date and source
Date checked:
github.com
Commit graded: 45ed6d9137650e1f5d42f0d378644b4d3fae8555
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.