Claude Code, Skill
echolot
Turns a huge Android trace into 20 rows of facts an AI agent can act
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
NETWORK_HOST_FROM_INPUT
Why this grade
- NETWORK_HOST_FROM_INPUT Medium
A file takes a URL or endpoint as input and has no fixed host list.
echolot/composenames.py, line 99
with urllib.request.urlopen(url, timeout=60) as resp:
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
setup.py, line 30
shutil.rmtree(target)
action/ci.py, line 118
done = subprocess.run([args.echolot, "analyze", "-c", args.config, "-o", str(out),
action/ci.py, line 301
done = subprocess.run([args.echolot, "compare", "baseline/report.json", "report.json",
Show more
docs/site.py, line 95
shutil.rmtree(out)
echolot/exclude.py, line 63
done = subprocess.run(["git", *args], cwd=cwd, capture_output=True, text=True,
echolot/plugin.py, line 198
shutil.rmtree(staging, ignore_errors=True)
echolot/runner.py, line 417
done = subprocess.run(args, input=stdin, capture_output=True,
echolot/runner.py, line 850
proc = subprocess.Popen(
echolot/runner.py, line 906
def _kill_tree(proc: subprocess.Popen) -> None:
echolot/tp.py, line 447
out = subprocess.run([bin_path, "--version"], capture_output=True,
.github/workflows/labels.yml, line 80
done = subprocess.run(["gh", "api", *args], check=True,
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Serious
accepts a host from input, with no fixed list in this file.
NETWORK_HOST_FROM_INPUT
echolot/composenames.py, line 99
with urllib.request.urlopen(url, timeout=60) as resp:
echolot/composenames.py, line 101
with urllib.request.urlopen(url + ".sha1", timeout=60) as resp:
echolot/mark.py, line 1139
# declaration - `return fetch(`, `new Runnable() {`, `else if (` - and a
Show more
echolot/tp.py, line 482
quoted a curl command line and said nothing a person could act on.
echolot/tp.py, line 569
ToolchainError without curl being run again; and an error that names the
echolot/tp.py, line 673
# under its temporary name when curl fails or the hash does not
echolot/tp.py, line 712
Said once, before curl starts and its progress bar with it, on stderr
echolot/tp.py, line 726
return (f"curl exited with status {e.returncode}"
echolot/tp.py, line 729
return "curl is not installed, or not on PATH"
echolot/tp.py, line 763
f"proxy, export HTTPS_PROXY - curl honours it - and run this again;\n"
echolot/selftest.py, line 2828
" return traces.trace<Items>(Marks.SPLIT) { fetch() }\n"
Secrets
Note
reads an environment variable.
SECRETS_ENV_READ
action/ci.py, line 265
os.environ.get("GITHUB_TOKEN", ""))
action/ci.py, line 403
os.environ.get("GITHUB_TOKEN", ""))
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read.
OBFUSCATION_FILE_OVER_READ_CAP
echolot/main.py, line 1
#!/usr/bin/env python3
echolot/selftest.py, line 1
"""The self-check: proof that the pipeline computes correctly on THIS machine.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit ae0e0ec9d95e. can delete files. accepts a host from input, with no fixed list in this file. reads an environment variable. a file was over the read cap and was not fully read.
Date and source
Date checked:
github.com
Commit graded: ae0e0ec9d95e7b7230afdf9c6c84f4d14145ffd9
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.