Claude Code, Skill
Codex Agent Orchestration Skill
This repository now ships two independent Codex skills:
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 3a2eac38a9e8, unchanged since the check below.
SECRETS_PATH_CREDENTIAL
Why this grade
- SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
skills/agy-second-opinion/scripts/build_agy_context_bundle.py, line 20
".npmrc",
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
scripts/install_skill.py, line 43
shutil.rmtree(path)
scripts/smoke_test.py, line 22
return subprocess.run(argv, text=True, capture_output=True, check=False, **kwargs)
skills/agy-second-opinion/scripts/build_agy_context_bundle.py, line 156
shutil.rmtree(stage)
Show more
skills/agy-second-opinion/scripts/run_agy_print.py, line 120
process = subprocess.Popen(
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Pass
No network call found.
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skills/agy-second-opinion/scripts/build_agy_context_bundle.py, line 18
".env",
skills/agy-second-opinion/scripts/build_agy_context_bundle.py, line 20
".npmrc",
skills/agy-second-opinion/scripts/build_agy_context_bundle.py, line 23
"credentials.json",
Show more
skills/agy-second-opinion/scripts/build_agy_context_bundle.py, line 24
"id_rsa",
skills/agy-second-opinion/scripts/build_agy_context_bundle.py, line 64
if any(part in BLOCKED_NAMES or part.startswith(".env.") for part in lowered_parts):
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 3a2eac38a9e8. can delete files. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 3a2eac38a9e8cf8888d388765fb5cbc3abcb881a
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.