Claude Code, Skill
Ego Jev
Jev (TypeSafe System One) inner loop for ego-browser — one ~0.4 s typed decision per DOM step instead of an LLM turn.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST OBFUSCATION_ENCODED_BLOB
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
docs/bench/eval/capture.mjs, line 27
for (const f of await fs.readdir(dir)) if (f !== "case.json") await fs.rm(`${dir}/${f}`); - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
docs/bench/baseline.mjs, line 11
const r = await fetch("https://ai-gateway.vercel.sh/v1/chat/co - NETWORK_UNNAMED_HOST Low
Calls a fixed host that the description does not name.
docs/bench/baseline.mjs, line 11
const r = await fetch("https://ai-gateway.vercel.sh/v1/chat/co - OBFUSCATION_ENCODED_BLOB Low
Contains a long base64 shaped string in a file that should be readable.
docs/promo/gallery-2.svg, line 13
<image xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABC4AAAMPCAIAAACVGgPsAAAQAElEQVR4nOzdB1yV9d//8euwQUBABERRcCtuc8/ce+Seuc1VaeYqRzacac6G9bMiNbO0ciXORHOl5lYcIAIKsvc8/D+
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
docs/bench/eval/capture.mjs, line 27
for (const f of await fs.readdir(dir)) if (f !== "case.json") await fs.rm(`${dir}/${f}`);
skills/ego-jev/scripts/jev-loop.test.ts, line 280
fs.rmSync(dir, { recursive: true, force: true });
skills/ego-jev/scripts/jev-loop.test.ts, line 317
fs.rmSync(dir, { recursive: true, force: true });
Show more
skills/ego-jev/scripts/jev-loop.test.ts, line 635
try { await fn(dir, shot); } finally { fs.rmSync(dir, { recursive: true, force: true }); }
skills/ego-jev/scripts/jev-loop.test.ts, line 726
fs.rmSync(dir, { recursive: true, force: true });
skills/ego-jev/scripts/jev-loop.test.ts, line 768
fs.rmSync(dir, { recursive: true, force: true });
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach ai-gateway.vercel.sh. The description does not name that host. can reach api.typesafe.ai. The description does not name that host. can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
docs/bench/baseline.mjs, line 11
const r = await fetch("https://ai-gateway.vercel.sh/v1/chat/co
skills/ego-jev/scripts/jev-loop.ts, line 633
const res = await fetch(`${opts.baseUrl ?? "https://api.typesafe.ai"}/v1/systemone`, {
skills/ego-jev/scripts/jev-loop.ts, line 673
const res = await fetch(
Show more
skills/ego-jev/SKILL.md, line 169
`page.fetch()`, which carries the page's cookies.
Secrets
Pass
No read of a credential file or secret environment variable found.
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains an encoded blob in a file that should be readable.
OBFUSCATION_ENCODED_BLOB
docs/promo/gallery-2.svg, line 13
<image xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABC4AAAMPCAIAAACVGgPsAAAQAElEQVR4nOzdB1yV9d//8euwQUBABERRcCtuc8/ce+Seuc1VaeYqRzacac6G9bMiNbO0ciXORHOl5lYcIAIKsvc8/D+
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 65d320ff97cd. can delete files. can reach ai-gateway.vercel.sh. The description does not name that host. can reach api.typesafe.ai. The description does not name that host. can reach a host that is not written as a fixed address. contains an encoded blob in a file that should be readable.
Date and source
Date checked:
github.com
Commit graded: 65d320ff97cddd7ef442337ae150a19a0c3c34a3
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.