Grades are a hygiene check, not a security guarantee.

Claude Code, Skill

Code Abyss

Give your AI coding agent a personality.

Compatibility: Not stated.

Grade D

Two or more Medium findings, or a High finding. Only try it in a sandbox.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

Rescanned at commit 2544577cf03a, unchanged since the check below.

INSTALL_REMOTE_SCRIPT SECRETS_PATH_CREDENTIAL AGENT_IGNORE_INSTRUCTIONS

Why this grade

  • INSTALL_REMOTE_SCRIPT High

    Fetches a script from the network and runs it (a pipe to a shell, or an install hook with a URL).

    bin/install.js, line 239 process.stderr.write(` ${c.b('迁移:')} ${c.d('curl -fsSL https://raw.githubusercontent.com/telagod/abyss/main/install.sh | bash')}\n`);

  • SECRETS_PATH_CREDENTIAL Medium

    Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).

    bin/adapters/claude.js, line 61 const cred = path.join(HOME, '.claude', '.credentials.json');

  • AGENT_IGNORE_INSTRUCTIONS Medium

    Text tells the agent to ignore earlier instructions.

    config/personas/_shared/injection-awareness.md, line 8 - 身份覆写：「你现在是…」「忘记之前的指令」「ignore previous instructions」「you are now」

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

If you think this grade is wrong, email [email protected] with the entry link and your evidence. We aim to acknowledge within two working days and decide within seven. If we confirm an error, we aim to correct it within 24 hours of confirming it. These are aims, not guarantees.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Concern

    can delete files.

    PERMISSION_DELETE_FILES

    bin/migrate-v3-to-v4.js, line 114

    fs.rmSync(p, { recursive: true, force: true });

    bin/packs.js, line 465

    fs.rmSync(commandPath, { force: true });

    bin/packs.js, line 472

    fs.rmSync(runtimeRoot, { recursive: true, force: true });

    Show more

    bin/uninstall.js, line 98

    fs.rmSync(p, { recursive: true, force: true });

    bin/uninstall.js, line 122

    fs.rmSync(backupDir, { recursive: true, force: true });

    bin/uninstall.js, line 123

    try { fs.unlinkSync(__filename); } catch { /* idempotent: 已删 */ }

    bin/lib/inject-plane.js, line 298

    fs.rmSync(dest, { force: true });

    bin/lib/pack-vendor.js, line 36

    shared.fs.rmSync(vendorDir, { recursive: true, force: true });

    skills/analyzing-security/references/rules.md, line 25

    os.system(cmd)

    skills/analyzing-security/references/rules.md, line 26

    subprocess.run(cmd, shell=True)

    skills/analyzing-security/references/rules.md, line 33

    subprocess.run([cmd, arg1, arg2], shell=False)

    skills/analyzing-security/references/rules.md, line 57

    exec.Command("sh", "-c", userInput)

    skills/analyzing-security/references/rules.md, line 61

    exec.Command("cmd", arg1, arg2) // args... 形式

    skills/analyzing-spreadsheets/recalc.py, line 31

    subprocess.run(['soffice', '--headless', '--terminate_after_init'],

    skills/analyzing-spreadsheets/recalc.py, line 84

    subprocess.run(['gtimeout', '--version'], capture_output=True, timeout=1, check=False)

    skills/analyzing-spreadsheets/recalc.py, line 92

    result = subprocess.run(cmd, capture_output=True, text=True)

  • Install and update

    Serious

    install fetches a script from the network. The docs document an installer that pipes a download into a shell. README documents an installer that pipes a download into a shell.

    INSTALL_REMOTE_SCRIPT INSTALL_DOCUMENTED_INSTALLER

    CHANGELOG.md, line 42

    curl -fsSL https://raw.githubusercontent.com/telagod/abyss/main/install.sh | bash

    README.md, line 78

    curl -fsSL https://raw.githubusercontent.com/telagod/abyss/main/install.sh | bash # abyss CLI (separate product)

    bin/install.js, line 239

    process.stderr.write(` ${c.b('迁移:')} ${c.d('curl -fsSL https://raw.githubusercontent.com/telagod/abyss/main/install.sh | bash')}\n`);

    Show more

    bin/lib/runtime-control.js, line 123

    'abyss CLI missing → curl -fsSL https://raw.githubusercontent.com/telagod/abyss/main/install.sh | bash',

    bin/lib/lifecycle/finish.js, line 34

    console.log(` ${c.b('升级:')} ${c.d('curl -fsSL https://raw.githubusercontent.com/telagod/abyss/main/install.sh | bash')}`);

    bin/lib/lifecycle/finish.js, line 40

    console.log(` ${c.d('curl -fsSL https://raw.githubusercontent.com/telagod/abyss/main/install.sh | bash')}`);

    bin/lib/lifecycle/finish.js, line 41

    console.log(` ${c.d('curl -fsSL https://cdn.jsdelivr.net/gh/telagod/abyss@main/install.sh | bash # raw 不可达时的镜像')}`);

    docs/MIGRATION-v5.md, line 16

    curl -fsSL https://raw.githubusercontent.com/telagod/abyss/main/install.sh | bash

    docs/README.zh-CN.md, line 72

    curl -fsSL https://raw.githubusercontent.com/telagod/abyss/main/install.sh | bash # 再装 abyss CLI

    skills/indexing-code/SKILL.md, line 120

    -with-abyss` **已移除**（Agent OS v5.1）。请用 `curl -fsSL https://raw.githubusercontent.com/telagod/abyss/main/install.sh | bash`；claude/codex/gemini graph hooks 用 `aby

    skills/securing-systems/references/red-team.md, line 80

    curl https://sliver.sh/install | sudo bash

  • Network

    Concern

    can reach a host that is not written as a fixed address. can reach 169.254.169.254. The description does not name that host. can reach api.example.com. The description does not name that host. can reach your-callback. The description does not name that host.

    NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

    bin/lib/persona-fetch.js, line 54

    function fetch(url, opts = {}) {

    bin/lib/persona-fetch.js, line 78

    return fetch(next, opts).then(resolve, reject);

    bin/lib/persona-fetch.js, line 103

    const raw = await fetch(cardUrl, opts);

    Show more

    skills/defending-applications/references/llm-appsec.md, line 152

    return requests.get(SEARCH_URL, params={"q": query, "key": API_KEY}).json()

    skills/defending-applications/references/web-api-appsec.md, line 119

    return httpx.get(url).text # 攻击者请求 http://169.254.169.254/latest/meta-data/

    skills/detecting-and-responding/references/threat-hunting.md, line 151

    curl -X POST -H "X-Caldera-Agent: sandcat" -O server:8888/sandcat.go

    skills/developing-software/go.md, line 136

    results[i] = fetch(url)

    skills/developing-software/python.md, line 94

    async def fetch(url: str) -> str:

  • Secrets

    Concern

    reads a credential or environment file.

    SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

    bin/adapters/claude.js, line 61

    const cred = path.join(HOME, '.claude', '.credentials.json');

    bin/adapters/gemini.js, line 30

    const adcPath = path.join(HOME, '.config', 'gcloud', 'application_default_credentials.json');

    bin/adapters/gemini.js, line 31

    if (fs.existsSync(adcPath)) return { type: 'adc', detail: 'gcloud application_default_credentials.json' };

    Show more

    scripts/persona-battery/judge.js, line 67

    // ~/.claude/.credentials.json, so `claude` can't log in there at all without

    scripts/persona-battery/judge.js, line 70

    if (process.env.ANTHROPIC_API_KEY) return;

    scripts/persona-battery/judge.js, line 71

    const src = path.join(os.homedir(), '.claude', '.credentials.json');

    scripts/persona-battery/judge.js, line 75

    fs.copyFileSync(src, path.join(destDir, '.credentials.json'));

    skills/analyzing-security/scripts/security_scanner.js, line 53

    '.rb', '.yaml', '.yml', '.json', '.env',

    skills/architecting-security/references/identity-and-zero-trust.md, line 231

    反模式: 长 token 在 .env / Vault / CI Secret

  • Agent instructions

    Serious

    instructions tell the agent to ignore earlier instructions.

    AGENT_IGNORE_INSTRUCTIONS

    config/personas/_shared/injection-awareness.md, line 8

    - 身份覆写：「你现在是…」「忘记之前的指令」「ignore previous instructions」「you are now」

    skills/cultivating-skills/references/safety-review.md, line 40

    ignore previous instructions

  • Obfuscation

    Note

    a file was over the read cap and was not fully read. the file cap was reached before every file was read.

    OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED

    skills/creating-presentations/ooxml/schemas/ISO-IEC29500-4_2016/sml.xsd, line 1

    <?xml version="1.0" encoding="utf-8"?>

    skills/processing-docx/ooxml/schemas/ISO-IEC29500-4_2016/sml.xsd, line 1

    <?xml version="1.0" encoding="utf-8"?>

    skills/processing-docx/ooxml/scripts/unpack.py, line 1

    #!/usr/bin/env python3

  • Licence

    Pass

    A licence file is present (LICENSE).

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 2544577cf03a. can delete files. install fetches a script from the network. The docs document an installer that pipes a download into a shell. README documents an installer that pipes a download into a shell. can reach a host that is not written as a fixed address. can reach 169.254.169.254. The description does not name that host. can reach api.example.com. The description does not name that host. can reach your-callback. The description does not name that host. reads a credential or environment file. instructions tell the agent to ignore earlier instructions. a file was over the read cap and was not fully read. the file cap was reached before every file

Date and source

Date checked:

View source

github.com

Commit graded: 2544577cf03a67522466450000731e52c64a5184

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen