Claude Code, Skill
Engineering Review Board
This repository is the canonical local source for reusable, project-neutral agent skills.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 52d53516759b, unchanged since the check below.
OBFUSCATION_MINIFIED_PAYLOAD
Why this grade
- OBFUSCATION_MINIFIED_PAYLOAD Medium
Contains a very long line with almost no spaces in a script or style file.
skills/impeccable/scripts/live-browser.js, line 1
/**
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Note
requests shell access. The manifest names this permission.
PERMISSION_SHELL_DECLARED
skills/powershell-engineering/SKILL.md, line 59
`Invoke-Expression`.
skills/powershell-engineering/SKILL.md, line 157
- `Invoke-Expression`, interpolated command strings, and unvalidated paths;
skills/security-review/SKILL.md, line 193
- **PowerShell:** check native-command arguments, `Invoke-Expression`, paths,
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
skills/impeccable/scripts/modern-screenshot.umd.js, line 7
tTimeout(()=>a.abort(),r):void 0;return fetch(t,D({signal:a.signal},i)).then(c=>{if(!c
skills/impeccable/scripts/live-browser.js, line 3808
const res = await fetch('http://localhost:' + PORT + '/manual-edit-stash?token=' + encodeURIComponent(TOKEN), {
skills/impeccable/scripts/live-browser.js, line 4124
const res = await fetch(
Show more
skills/impeccable/scripts/live-browser.js, line 4144
const res = await fetch(
skills/impeccable/scripts/live-browser.js, line 4188
const res = await fetch(
skills/impeccable/scripts/live-browser.js, line 4237
const res = await fetch(
skills/impeccable/scripts/live-browser.js, line 4256
const res = await fetch(
skills/impeccable/scripts/live-browser.js, line 5324
const res = await fetch(url);
skills/impeccable/scripts/live-browser.js, line 5797
const res = await fetch(url);
skills/impeccable/scripts/live-browser.js, line 7151
fetch('http://localhost:' + PORT + '/agent-target-result?token=' + TOKEN, {
skills/impeccable/scripts/live-browser.js, line 7273
return fetch('http://localhost:' + PORT + '/agent-target-claim?token=' + TOKEN, {
skills/impeccable/scripts/live-browser.js, line 7798
const doSend = () => fetch('http://localhost:' + PORT + '/events?token=' + encodeURIComponent(TOKEN), {
skills/impeccable/scripts/live-browser.js, line 11559
fetch('http://localhost:' + PORT + '/status?token=' + TOKEN, { cache: 'no-store' })
skills/impeccable/scripts/live-browser.js, line 11571
fetch('http://localhost:' + PORT + '/status?token=' + TOKEN, { cache: 'no-store' })
skills/impeccable/scripts/live-browser.js, line 12747
fetch(`http://localhost:${PORT}/design-system.json?token=${TOKEN}`, { cache: 'no-store' }),
skills/impeccable/scripts/live-browser.js, line 12748
fetch(`http://localhost:${PORT}/design-system/raw?token=${TOKEN}`, { cache: 'no-store' }),
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
skills/documentation-engineering/SKILL.md, line 137
live secrets, no credentialed URLs, no ambient `.env` assumptions.
skills/javascript-typescript-engineering/SKILL.md, line 311
auth, sessions, cookies, CSRF/CORS/CSP, cryptography, secrets, `.env`, command
skills/justfiles/SKILL.md, line 249
- Using `.env` values as `{{JUST_VARIABLES}}` instead of shell `$VARIABLES`.
Show more
skills/playwright-e2e/SKILL.md, line 166
state, cookies, CSRF/session values, credentialed URLs, local paths, `.env`
skills/python-engineering/SKILL.md, line 270
implemented auth, sessions, crypto, credentials, secrets or `.env`,
skills/rust-engineering/SKILL.md, line 206
`.env`, filesystem paths, command/process execution, `unsafe`, FFI, plugin
skills/rust-testing-quality/SKILL.md, line 199
`.env`, real databases, timing assumptions, and large setup.
skills/security-review-evidence/SKILL.md, line 11
`.env` handling, credential handling, trust boundaries, security-sensitive input
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains a minified payload.
OBFUSCATION_MINIFIED_PAYLOAD
skills/impeccable/scripts/live-browser.js, line 1
/**
skills/impeccable/scripts/modern-screenshot.umd.js, line 6
`);return t.appendChild(r),t}function pt(e,t){let{width:r,height:n}=t;if(I(e)&&(!r||!n)){const i=e.getBoundingClientRect();r=r||i.width||Number(e.getAttribute("width"))||0,n=n||i.h
skills/impeccable/scripts/data/font-index.json, line 1
{"schema":2,"text":"The quick brown fox jumps over the lazy dog 0123456789 HAMBURGEVONS","textCaps":"THE QUICK BROWN FOX JUMPS OVER THE LAZY DOG 0123456789 HAMBURGEVONS","sizes":[4
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 52d53516759b. requests shell access. The manifest names this permission. can reach a host that is not written as a fixed address. reads a credential or environment file. contains a minified payload.
Date and source
Date checked:
github.com
Commit graded: 52d53516759bd38f2795d38efc8f6b915b71b165
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.