Claude Code, Skill
Dazzle Claude Config Sync
Git-backed sync for your Claude Code configuration (skills, commands, agents, hooks, and CLAUDE.md) across every machine you work on, with credential protection on the way in and backups on every write.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit ecc02c883f5a, unchanged since the check below.
SECRETS_PATH_CREDENTIAL
Why this grade
- SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
dazzle_claude_config/secrets.py, line 17
".credentials.json",
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
dazzle_claude_config/aideep.py, line 85
return subprocess.run(["git", "-C", str(cwd), *args], capture_output=True, text=True,
dazzle_claude_config/aisandbox.py, line 75
return subprocess.run(["git", "-C", str(cwd), *args], capture_output=True, text=True,
dazzle_claude_config/aisandbox.py, line 107
shutil.rmtree(path, ignore_errors=True)
Show more
dazzle_claude_config/aisandbox.py, line 205
r = subprocess.run(["git", "-C", str(sb.checkout), "show", f"HEAD:{parts[1]}", "--"],
dazzle_claude_config/basefind.py, line 228
r = subprocess.run(["git", "merge-file", "-p", "--diff3",
dazzle_claude_config/basefind.py, line 337
r = subprocess.run(["git", "-C", repo, "show", f"{sha}:{path}", "--"], capture_output=True)
dazzle_claude_config/basefind.py, line 341
short = subprocess.run(["git", "-C", repo, "rev-parse", "--short", sha],
dazzle_claude_config/cli.py, line 120
return subprocess.call(["git", "-C", str(checkout), *git_args])
dazzle_claude_config/cli.py, line 1371
shown = subprocess.run(["git", "show", f"HEAD:{repo_path}", "--"],
dazzle_claude_config/_vendor/ailib/transports/cli.py, line 213
shutil.rmtree(scratch, ignore_errors=True)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
dazzle_claude_config/cli.py, line 664
fetched, why = repo.fetch(timeout=int(cfg.get("fetch_timeout", 15)))
dazzle_claude_config/cli.py, line 2061
fetched, detail = repo.fetch(timeout=int((cfg or {}).get("fetch_timeout", 15)))
dazzle_claude_config/cli.py, line 2695
# fetch (the first round trip read "in sync with origin/main" only
Show more
dazzle_claude_config/gitops.py, line 94
def fetch(self, timeout: int = 15) -> tuple[bool | None, str]:
dazzle_claude_config/_vendor/ailib/transports/openai_compat.py, line 207
with urllib.request.urlopen(req, timeout=timeout) as r: # noqa: S310
dazzle_claude_config/_vendor/ailib/transports/openai_compat.py, line 346
with urllib.request.urlopen(http, timeout=ceiling) as r: # noqa: S310
docs/ai-merge.md, line 84
- the checkout's position against its remote, as of the last fetch (`--ai` never fetches);
docs/stats/index.html, line 1128
var response = await fetch(STATE_URL + '?t=' + Date.now());
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_CREDENTIAL
dazzle_claude_config/ailib.py, line 28
(`~/claude/keys/<preset>.env`, user territory). The library's read order
dazzle_claude_config/ailib.py, line 139
`<preset>.env` per provider, holding a `NAME=value` line. Read only when
dazzle_claude_config/secrets.py, line 17
".credentials.json",
Show more
dazzle_claude_config/ailib.py, line 154
`<keys_dir>/<name>.env` is the one fallback. A preset that needs no key
dazzle_claude_config/ailib.py, line 177
spec = spec.with_(credential_fallbacks=(str(Path(keys_dir) / f"{name}.env"),))
dazzle_claude_config/aistep.py, line 107
(`<keys_dir>/<preset>.env`, read only when the environment has nothing).
.gitignore, line 70
ENV/
.gitignore, line 112
# Environment files
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
the file cap was reached before every file was read.
OBFUSCATION_FILE_CAP_REACHED
tests/mutation/v058-report-round2.json, line 1
{
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit ecc02c883f5a. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. the file cap was reached before every file was read.
Date and source
Date checked:
github.com
Commit graded: ecc02c883f5a07a454661f1b964793393de9c94c
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.