Claude Code, Skill
Code Virtuoso
Code Virtuoso, a skill listed in the PlugVet directory.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit b593433ffcb2, unchanged since the check below.
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV SECRETS_ENV_READ OBFUSCATION_FILE_CAP_REACHED
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
skills/knowledge/solid/references/lsp.md, line 303
os.remove(f"/data/{key}.txt") - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
skills/frameworks/django/django-components/references/security.md, line 49
fetch('/api/endpoint/', { - NETWORK_UNNAMED_HOST Low
Calls a fixed host that the description does not name.
skills/frameworks/django/django-components/references/security.md, line 49
fetch('/api/endpoint/', { - SECRETS_PATH_DOTENV Low
Mentions a .env file.
skills/frameworks/langchain/langchain-components/references/langgraph-advanced.md, line 458
├── .env - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
skills/frameworks/django/django-components/references/deployment.md, line 180
os.environ.get("OLD_SECRET_KEY", ""), - OBFUSCATION_FILE_CAP_REACHED Note
The 400 file cap was reached before every file was read.
skills/tools/plugin-creator/references/component-templates.md, line 1
# Component Templates
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
skills/knowledge/solid/references/lsp.md, line 303
os.remove(f"/data/{key}.txt")
skills/knowledge/solid/references/lsp.md, line 345
os.remove(f"/data/{key}.txt")
skills/tools/web-screenshot/scripts/multi_viewport.py, line 53
subprocess.run(cmd, check=True)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address. can reach your-deployment.us.langgraph.app. The description does not name that host. can reach service. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
skills/frameworks/django/django-components/references/security.md, line 49
fetch('/api/endpoint/', {
skills/frameworks/langchain/langchain-components/references/langgraph-advanced.md, line 422
return requests.post(API_URL, json=data).json()
skills/frameworks/langchain/langchain-components/references/testing.md, line 189
curl -X POST https://your-deployment.us.langgraph.app/runs \
Show more
skills/frameworks/symfony/symfony-components/references/contracts.md, line 153
public function fetch(string $url): array {
skills/knowledge/cicd/references/environment-management.md, line 197
local actual=$(curl -s -o /dev/null -w "%{http_code}" "${BASE_URL}${1}")
skills/knowledge/solid/references/dip.md, line 47
$order = $stmt->fetch();
skills/knowledge/solid/references/dip.md, line 117
$row = $stmt->fetch();
skills/knowledge/solid/references/dip.md, line 185
WeatherData fetch(String city);
skills/knowledge/verification-before-completion/references/evidence-patterns.md, line 147
$ curl -s -w "\nHTTP_CODE:%{http_code}\n" http://localhost:8080/api/users/1
skills/knowledge/verification-before-completion/references/verification-checklist.md, line 113
curl -s -o /dev/null -w "%{http_code}" http://localhost:8080/health
skills/knowledge/verification-before-completion/references/verification-checklist.md, line 114
curl -s http://localhost:8080/api/affected-endpoint | head -20
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
skills/frameworks/django/django-components/references/deployment.md, line 180
os.environ.get("OLD_SECRET_KEY", ""),
skills/frameworks/django/django-components/references/settings.md, line 414
"PASSWORD": os.environ.get("DB_PASSWORD", ""),
skills/frameworks/langchain/langchain-components/references/langgraph-advanced.md, line 458
├── .env
Show more
skills/frameworks/langchain/langchain-components/references/langgraph-advanced.md, line 471
"env": "./.env"
skills/frameworks/symfony/symfony-components/references/yaml.md, line 522
$config = Yaml::parseFile('.env.yaml');
skills/knowledge/cicd/references/environment-management.md, line 83
CONFIG_FILE="config/${ENV}.env"
skills/knowledge/verification-before-completion/references/verification-checklist.md, line 94
dotenv-linter .env
skills/tools/agentic-rules-writer/SKILL.md, line 388
- Never commit secrets, .env files, API keys, or credentials to version control
skills/tools/agentic-rules-writer/SKILL.md, line 472
- Never commit secrets, .env files, API keys, or credentials to version control
skills/tools/agentic-rules-writer/SKILL.md, line 574
- Never read, commit, or log .env files, credentials, API keys, or secrets
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
the file cap was reached before every file was read.
OBFUSCATION_FILE_CAP_REACHED
skills/tools/plugin-creator/references/component-templates.md, line 1
# Component Templates
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit b593433ffcb2. can delete files. can reach a host that is not written as a fixed address. can reach your-deployment.us.langgraph.app. The description does not name that host. can reach service. The description does not name that host. reads a credential or environment file. the file cap was reached before every file was read.
Date and source
Date checked:
github.com
Commit graded: b593433ffcb227bd4034f94d5dee6e2a48859e76
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.