Grades are a hygiene check, not a security guarantee.

Claude Code, Skill

creo

AI-powered design, UX, content, DevOps, testing, and performance toolkit for Claude Code.

Compatibility: Not stated.

Grade D

Two or more Medium findings, or a High. Only try it in a sandbox.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

INSTALL_REMOTE_SCRIPT

Why this grade

  • INSTALL_REMOTE_SCRIPT High

    Fetches a script from the network and runs it (a pipe to a shell, or an install hook with a URL).

    install.sh, line 83 echo "To uninstall: curl -fsSL ${REPO_URL}/raw/main/uninstall.sh | bash"

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

If you think this grade is wrong, email [email protected] with the entry link and your evidence. We aim to acknowledge within two working days and decide within seven. If we confirm an error, we aim to correct it within 24 hours of confirming it. These are aims, not guarantees.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Note

    requests shell access. The manifest names this permission.

    PERMISSION_SHELL_DECLARED

    update.ps1, line 20

    Invoke-Expression ((Invoke-WebRequest -Uri "$RepoUrl/raw/main/uninstall.ps1" -UseBasicParsing).Content)

    update.ps1, line 26

    Invoke-Expression ((Invoke-WebRequest -Uri "$RepoUrl/raw/main/install.ps1" -UseBasicParsing).Content)

    extensions/i18n-translator/scripts/run_translation.py, line 34

    result = subprocess.run(

    Show more

    extensions/i18n-translator/scripts/run_translation.py, line 53

    result = subprocess.run(

  • Install and update

    Serious

    install fetches a script from the network. README documents an installer that pipes a download into a shell. The docs document an installer that pipes a download into a shell.

    INSTALL_REMOTE_SCRIPT INSTALL_DOCUMENTED_INSTALLER

    README.md, line 84

    curl -fsSL https://raw.githubusercontent.com/oyusypenko/creo/main/install.sh | bash

    README.md, line 135

    curl -fsSL https://raw.githubusercontent.com/oyusypenko/creo/main/update.sh | bash

    install.sh, line 83

    echo "To uninstall: curl -fsSL ${REPO_URL}/raw/main/uninstall.sh | bash"

    Show more

    README.md, line 266

    ithub.com/creo-kit/claude-seo-audit) | `curl -fsSL https://raw.githubusercontent.com/creo-kit/claude-seo-audit/main/install.sh \| bash` |

    README.md, line 267

    b.com/creo-kit/claude-design-review) | `curl -fsSL https://raw.githubusercontent.com/creo-kit/claude-design-review/main/install.sh \| bash` |

    README.md, line 268

    om/creo-kit/claude-design-implement) | `curl -fsSL https://raw.githubusercontent.com/creo-kit/claude-design-implement/main/install.sh \| bash` |

    README.md, line 269

    | **UX Audit** | [claude-ux-audit](https://github.com/creo-kit/claude-ux-audit) | `curl -fsSL https://raw.githubusercontent.com/creo-kit/claude-ux-audit/main/install.sh \| bash` |

    README.md, line 270

    creo-kit/claude-competitor-analysis) | `curl -fsSL https://raw.githubusercontent.com/creo-kit/claude-competitor-analysis/main/install.sh \| bash` |

    README.md, line 271

    m/creo-kit/claude-marketing-content) | `curl -fsSL https://raw.githubusercontent.com/creo-kit/claude-marketing-content/main/install.sh \| bash` |

    README.md, line 272

    ub.com/creo-kit/claude-image-prompt) | `curl -fsSL https://raw.githubusercontent.com/creo-kit/claude-image-prompt/main/install.sh \| bash` |

    README.md, line 273

    .com/creo-kit/claude-devops-toolkit) | `curl -fsSL https://raw.githubusercontent.com/creo-kit/claude-devops-toolkit/main/install.sh \| bash` |

    README.md, line 274

    hub.com/creo-kit/claude-ci-pipeline) | `curl -fsSL https://raw.githubusercontent.com/creo-kit/claude-ci-pipeline/main/install.sh \| bash` |

    README.md, line 275

    m/creo-kit/claude-test-orchestrator) | `curl -fsSL https://raw.githubusercontent.com/creo-kit/claude-test-orchestrator/main/install.sh \| bash` |

    README.md, line 276

    .com/creo-kit/claude-marketing-site) | `curl -fsSL https://raw.githubusercontent.com/creo-kit/claude-marketing-site/main/install.sh \| bash` |

    README.md, line 277

    b.com/creo-kit/claude-ai-generation) | `curl -fsSL https://raw.githubusercontent.com/creo-kit/claude-ai-generation/main/install.sh \| bash` |

    README.md, line 334

    curl -fsSL https://raw.githubusercontent.com/oyusypenko/creo/main/uninstall.sh | bash

    update-check.sh, line 42

    printf ' Update: curl -fsSL https://raw.githubusercontent.com/%s/main/update.sh | bash\n' \

    update.sh, line 24

    curl -fsSL "${REPO_URL}/raw/main/uninstall.sh" | bash >/dev/null 2>&1 || true

    update.sh, line 28

    curl -fsSL "${REPO_URL}/raw/main/install.sh" | bash

    docs/INSTALLATION.md, line 61

    curl -fsSL https://raw.githubusercontent.com/oyusypenko/creo/main/install.sh | bash

    docs/INSTALLATION.md, line 140

    curl -fsSL https://raw.githubusercontent.com/oyusypenko/creo/main/uninstall.sh | bash

    docs/spinoffs/creo-content-README.md, line 23

    curl -fsSL https://raw.githubusercontent.com/oyusypenko/creo-content/main/install.sh | bash

    docs/spinoffs/creo-design-review-README.md, line 23

    curl -fsSL https://raw.githubusercontent.com/oyusypenko/creo-design-review/main/install.sh | bash

    docs/spinoffs/creo-seo-README.md, line 23

    curl -fsSL https://raw.githubusercontent.com/oyusypenko/creo-seo/main/install.sh | bash

    .github/release-notes-v1.0.0.md, line 32

    curl -fsSL https://raw.githubusercontent.com/oyusypenko/creo/main/install.sh | bash

  • Network

    Concern

    can reach a host that is not written as a fixed address. can reach openai.com. The description does not name that host. can reach acme.com. The description does not name that host. can reach cms.acme.com. The description does not name that host. can reach api.acme.com. The description does not name that host.

    NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

    update-check.sh, line 9

    # CREO_TIMEOUT curl timeout seconds (default: 3)

    update-check.sh, line 25

    # fall back to git ls-remote if curl fails.

    update-check.sh, line 26

    REMOTE_SHA=$(curl -fsSL -m "${TIMEOUT}" \

    Show more

    extensions/gsc-analyzer/gsc_toolkit/analyzers/indexing.py, line 107

    response = requests.get(sitemap_url, timeout=30)

    extensions/gsc-analyzer/gsc_toolkit/analyzers/pagespeed.py, line 42

    response = requests.get(self.API_URL, params=params, timeout=60)

    extensions/gsc-analyzer/gsc_toolkit/audit/seo_audit.py, line 301

    "Confirm the HTTP status: curl -I <url> (expect 404)",

    extensions/gsc-analyzer/scripts/gsc_autofix_detect.py, line 175

    with urllib.request.urlopen(req, timeout=60) as resp:

    extensions/gsc-analyzer/scripts/gsc_autofix_verify.sh, line 64

    out=$(curl "${CURL_OPTS[@]}" -L --max-redirs 3 \

    extensions/i18n-translator/agents/creo-i18n.md, line 32

    curl -s http://localhost:1234/v1/models | head -1

    skills/creo-seo/references/deploy-verification.md, line 26

    curl -s https://example.com/sitemap.xml -o edge.out

    skills/creo-seo/references/deploy-verification.md, line 28

    curl -s "https://example.com/sitemap.xml?cb=$(date +%s)" -o origin.out

    skills/creo-seo/references/indexation-runbook.md, line 43

    curl -s https://example.com/sitemap.xml | grep -oE '/recipes/[^"<]+' | wc -l

    skills/creo-seo/references/schema-validation-checklist.md, line 169

    const res = await fetch('http://localhost:3000')

    skills/creo-seo/references/seo-program-conventions.md, line 40

    Verify: curl -sL https://example.com/pricing | grep -o '"@type":"[^"]*"'

  • Secrets

    Concern

    reads a credential or environment file.

    SECRETS_ENV_READ SECRETS_PATH_DOTENV

    agents/creo-e2e-test.md, line 79

    await page.getByLabel('Password').fill(process.env.TEST_USER_PASSWORD!);

    agents/creo-railway-cli.md, line 63

    railway variables set --from-file .env

    extensions/gsc-analyzer/gsc_toolkit/gsc_client.py, line 114

    print_error("Site URL not configured. Set GSC_SITE_URL in .env")

    Show more

    extensions/gsc-analyzer/gsc_toolkit/gsc_client.py, line 190

    print_error("Site URL not configured. Set GSC_SITE_URL in .env")

    extensions/gsc-analyzer/gsc_toolkit/gsc_client.py, line 270

    print_error("Site URL not configured. Set GSC_SITE_URL in .env")

    extensions/gsc-analyzer/gsc_toolkit/gsc_client.py, line 363

    print_error("Site URL not configured. Set GSC_SITE_URL in .env")

    extensions/gsc-analyzer/gsc_toolkit/core/config.py, line 8

    load_dotenv(dotenv_path=Path.cwd() / '.env')

    extensions/gsc-analyzer/gsc_toolkit/core/config.py, line 11

    KEY_FILE = os.getenv('GSC_KEY_FILE', './service-account-key.json')

    extensions/gsc-analyzer/gsc_toolkit/core/config.py, line 17

    PAGESPEED_API_KEY = os.getenv('PAGESPEED_API_KEY', '') # Optional, increases quota

    extensions/gsc-analyzer/scripts/gsc_autofix_detect.py, line 102

    key_file = os.environ.get("GSC_KEY_FILE") or os.environ.get(

    extensions/gsc-analyzer/scripts/gsc_request_reindex.py, line 84

    key_file = os.environ.get("GSC_KEY_FILE") or os.environ.get(

    extensions/gsc-analyzer/scripts/pull_semantic_core.py, line 82

    explicit = os.environ.get("GSC_KEY_FILE")

    extensions/gsc-analyzer/scripts/pull_semantic_core.py, line 85

    google_default = os.environ.get("GOOGLE_APPLICATION_CREDENTIALS")

    extensions/gsc-analyzer/scripts/pull_trends_12w.py, line 121

    explicit = os.environ.get("GSC_KEY_FILE")

    extensions/image-generation/install.ps1, line 54

    # Copy .env.example

    extensions/image-generation/install.ps1, line 55

    $envExample = Join-Path $ScriptDir ".env.example"

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Pass

    No encoded or minified payload found.

  • Licence

    Pass

    A licence file is present (LICENSE).

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 12af43bcc5a2. requests shell access. The manifest names this permission. install fetches a script from the network. README documents an installer that pipes a download into a shell. The docs document an installer that pipes a download into a shell. can reach a host that is not written as a fixed address. can reach openai.com. The description does not name that host. can reach acme.com. The description does not name that host. can reach cms.acme.com. The description does not name that host. can reach api.acme.com. The description does not name that host. reads a credential or environment file.

Date and source

Date checked:

View source

github.com

Commit graded: 12af43bcc5a2001699c6f276bc2959546d34fba2

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen