Claude Code, Plugin
Config Drift Checker
CI for your coding-agent setup (CLAUDE.md, skills, hooks): pinned baselines, a canary on every Claude Code release, model and version matrix, context-cost drift, self-diagnosing reports, repair.
Compatibility: Not stated.
Grade D
Two or more Medium findings, or a High finding. Only try it in a sandbox.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit c03a65f28d46.
SECRETS_PATH_CREDENTIAL OBFUSCATION_MINIFIED_PAYLOAD
Why this grade
- SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
config-drift-checker/tools/eval-shim.mjs, line 264
for (const f of ['.credentials.json']) if (existsSync(path.join(userConfig, f))) await fs.copyFile(path.join(userConfig, f), path.join(dir, f)); - OBFUSCATION_MINIFIED_PAYLOAD Medium
Contains a very long line with almost no spaces in a script or style file.
config-drift-checker/tools/eval-dashboard.mjs, line 163
.tablewrap{overflow-x:auto;border:1px solid var(--rule);border-radius:8px;background:var(--surface);box-shadow:var(--shadow)}table{border-collapse:collapse;width:100%;font-size:13.
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
config-drift-checker/tools/cc-release.mjs, line 43
const cleanup = () => fs.rm(prefix, { recursive: true, force: true }).catch(() => {});
config-drift-checker/tools/cc-release.mjs, line 94
if (reason) { note = `official runner gave no usable result (${reason}); fell back to the shim`; used = 'shim'; await fs.rm(file, { force: true }); }
config-drift-checker/tools/cc-release.mjs, line 141
return { dir: view, cases, evalDir: path.join(view, evalRel), cleanup: () => fs.rm(view, { recursive: true, force: true }).catch(() => {}) };
Show more
config-drift-checker/tools/drift-matrix.mjs, line 151
await fs.rm(tmp, { recursive: true, force: true }).catch(() => {});
config-drift-checker/tools/eval-shim.mjs, line 314
if (cfg) await fs.rm(cfg, { recursive: true, force: true });
config-drift-checker/tools/eval-shim.mjs, line 315
await fs.rm(ws, { recursive: true, force: true });
config-drift-checker/tools/eval-shim.mjs, line 332
if (cfg) await fs.rm(cfg, { recursive: true, force: true });
config-drift-checker/tools/eval-shim.mjs, line 333
await fs.rm(ws, { recursive: true, force: true });
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
config-drift-checker/tools/release-report.mjs, line 104
const res = await fetch(`${base}/${endpoint}`, { headers: { acce
config-drift-checker/tools/release-watch.mjs, line 44
const res = await fetch(url, { headers: { 'x-api-key': key, 'anthropic-version': '2023-06-01' }, signal: AbortSignal.timeout(15_000) });
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL
config-drift-checker/tools/release-watch.mjs, line 41
hropic.com/v1/models?limit=1000', key = process.env.ANTHROPIC_API_KEY || process.env.CDC_MODELS_API_KEY) {
config-drift-checker/tools/cc-release.mjs, line 49
const withBin = (binDir, env = process.env) => ({ ...env, PATH: `${binDir}${path.delimiter}${env.PATH ?? ''}` });
config-drift-checker/tools/eval-shim.mjs, line 264
for (const f of ['.credentials.json']) if (existsSync(path.join(userConfig, f))) await fs.copyFile(path.join(userConfig, f), path.join(dir, f));
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains a minified payload.
OBFUSCATION_MINIFIED_PAYLOAD
config-drift-checker/tools/eval-dashboard.mjs, line 163
.tablewrap{overflow-x:auto;border:1px solid var(--rule);border-radius:8px;background:var(--surface);box-shadow:var(--shadow)}table{border-collapse:collapse;width:100%;font-size:13.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit c03a65f28d46. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. contains a minified payload.
Date and source
Date checked:
github.com
Commit graded: c03a65f28d462440184befde269d6a25c24b5e7c
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.