Claude Code, Skill
Cst Paper Sim Skills
10 个 skill，覆盖 读论文 → 提参数 → 公式扫雷 → CST 建模仿真 → 结果汇报 → 三方验证 → 创新提炼 全链路。 技能格式为通用 Agent Skills（SKILL.md + 资源文件夹），ZCode / Claude Code 等均可用。 所有流程与坑清单均在 CST Studio Suite 2025 真机实测。
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 92fce47d702f, unchanged since the check below.
PERMISSION_DELETE_FILES SECRETS_PATH_DOTENV SECRETS_ENV_READ
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
skills/cst-automation/scripts/remote/spawn_detached.py, line 43
p = subprocess.Popen( - SECRETS_PATH_DOTENV Low
Mentions a .env file.
skills/vision/vision.js, line 19
* GLM_API_KEY 环境变量 或 同目录 .env 文件 - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
skills/vision/vision.js, line 53
const API_KEY = process.env.GLM_API_KEY || process.env.ZHIPU_API_KEY || "";
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
skills/cst-automation/scripts/remote/spawn_detached.py, line 43
p = subprocess.Popen(
skills/cst-em-sim/SKILL.md, line 58
subprocess.run(["powershell", "-Command",
skills/cst-em-sim/scripts/fix_export_history.py, line 30
subprocess.run(["powershell", "-Command",
Show more
skills/cst-em-sim/scripts/fix_export_history.py, line 123
shutil.rmtree(d, ignore_errors=True)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Pass
No network call found.
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
skills/vision/vision.js, line 19
* GLM_API_KEY 环境变量 或 同目录 .env 文件
skills/vision/vision.js, line 30
// 加载 .env（内置迷你解析器，无需 dotenv 依赖）
skills/vision/vision.js, line 53
const API_KEY = process.env.GLM_API_KEY || process.env.ZHIPU_API_KEY || "";
Show more
skills/vision/vision.js, line 31
// 优先级：脚本所在目录 .env > 当前工作目录 .env
skills/vision/vision.js, line 47
loadEnv(path.resolve(__dirname, ".env"));
skills/vision/vision.js, line 48
loadEnv(path.resolve(process.cwd(), ".env"));
skills/vision/vision.js, line 55
const MAX_TOKENS = parseInt(process.env.VISION_MAX_TOKENS || "2048", 10);
skills/vision/vision.js, line 164
console.error("请设置 GLM_API_KEY 环境变量，或在同目录 .env 文件中配置。");
.gitignore, line 5
# 环境配置（含 API Key，绝不入库）
README.md, line 78
- 要启用 vision.js：装 Node.js，把 `skills/vision/.env.example` 复制为 `.env`，填入你自己的智谱 API Key（https://open.bigmodel.cn ，按量计费）。
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 92fce47d702f. can delete files. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 92fce47d702ff37a655ec3d165c8eaffa70fc363
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.