Grades are a hygiene check, not a security guarantee.

Claude Code, Skill

Eo Skills

一套开发工作流 skill 集合，可装进任何支持 Agent Skills 约定的 agent（Claude Code / Codex / Antigravity 等）。以 change 工件为核心，配套可选的 codegraph 代码召回与 agent-handbook 项目操作手册，把从构思、变更、实施、测试、审查到归档的全流程拆成可独立调用的 skill，并支持跨 agent 协作。

Compatibility: Not stated.

Grade C

One Medium finding. Read the report before installing.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

INSTALL_REMOTE_SCRIPT

Why this grade

  • INSTALL_REMOTE_SCRIPT Medium

    Fetches a script from the network and runs it (a pipe to a shell, or an install hook with a URL).

    install.sh, line 9 curl -fsSL https://raw.githubusercontent.com/SimpleEve/eo-skills/main/install.sh | sh

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Note

    requests shell access. The manifest names this permission.

    PERMISSION_SHELL_DECLARED

    cli/eo_lib/gitio.py, line 23

    res = subprocess.run(

    cli/eo-helper, line 57

    rc = subprocess.run(argv).returncode

    cli/eo-sync, line 107

    proc = subprocess.run(

    Show more

    cli/eo-sync-github, line 39

    out = subprocess.run(["git", "remote"], cwd=repo_root, capture_output=True, text=True, timeout=10)

    cli/eo-sync-github, line 52

    r = subprocess.run(["gh", "auth", "status"], cwd=repo_root, capture_output=True, text=True, timeout=15)

    cli/eo-sync-github, line 176

    out = subprocess.run(

    cli/eo-sync-github, line 203

    return subprocess.run(["gh", *args], cwd=cwd, capture_output=True, text=True, timeout=120)

    eo-doc/changes/08-eo-helper-entry/review.md, line 35

    `subprocess.run`，长驻命令使用 `os.execvp`；聚合 serve 每次重读注册表，

  • Install and update

    Serious

    install fetches a script from the network. README documents an installer that pipes a download into a shell.

    INSTALL_REMOTE_SCRIPT INSTALL_DOCUMENTED_INSTALLER

    README.md, line 34

    curl -fsSL https://raw.githubusercontent.com/SimpleEve/eo-skills/main/install.sh | sh

    install.sh, line 9

    curl -fsSL https://raw.githubusercontent.com/SimpleEve/eo-skills/main/install.sh | sh

  • Network

    Concern

    can reach a host that is not written as a fixed address.

    NETWORK_NO_FIXED_HOST

    cli/eo-board, line 2601

    fetch(DATA_URL, { cache: 'no-store' }).then(function (r) { return r.text(); }).then(function (text) {

    cli/eo-board, line 3630

    fetch('/data.json', { cache: 'no-store' }).then(function (r) { return r.text(); }).then(function (text) {

    eo-doc/changes/10-board-all-v2/change-review.md, line 76

    §5 只写聚合 `/data.json`，对单项目数据说“沿用其既有端点形态按路由取用”。当前单项目 HTML 模板硬编码 `fetch('/data.json')`（`cli/eo-board:1398-1420`），聚合 handler 的 `/data.json` 又明确返回聚合数据（`cli/eo-board:1966-1992`）。如果把现有 `r

    Show more

    eo-doc/changes/10-board-all-v2/change.md, line 90

    - **路由表（serve）**：`/` 首页壳（change 流 + 概要卡双视图，hash 管视图态）；`/p/<route_key>` 单项目泳道页（复用既有单项目模板 + 返回入口注入，返回指向 `/` 默认 change 流视图，浏览器返回键按历史恢复）；`/data.json` 聚合数据（rows 已抬升 change 明细）；`/p/<rout

  • Secrets

    Pass

    No read of a credential file or secret environment variable found.

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Pass

    No encoded or minified payload found.

  • Licence

    Pass

    A licence file is present (LICENSE).

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit a5062887a6ab. requests shell access. The manifest names this permission. install fetches a script from the network. README documents an installer that pipes a download into a shell. can reach a host that is not written as a fixed address.

Date and source

Date checked:

View source

github.com

Commit graded: a5062887a6abcb255b4745f871208be292484bfa

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen