Claude Code, Skill
fables
fables, a skill listed in the PlugVet directory.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 9c7f5b7cafba, unchanged since the check below.
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
Why this grade
- NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
android/references/coroutines-lifecycle.md, line 23
- ❌ ViewModel 每次呼叫都 `withContext(Dispatchers.IO) { repo.fetch() }` - - 防禦性切換散落各處，漏一處就 ANR。 - SECRETS_PATH_DOTENV Low
Mentions a .env file.
backend-server/references/auth-security.md, line 43
- **禁進 git**（含 `.env` 被誤 commit） - - git 歷史永久保存，`git rm` 後歷史仍在，一旦推上遠端就當作已外洩、必須輪替。
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command call was found in the code. This check does not read permissions an entry declares. A permission line to run shell commands, write or edit files and fetch web content was found in this repository, and it may apply to this entry.
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
android/references/coroutines-lifecycle.md, line 23
- ❌ ViewModel 每次呼叫都 `withContext(Dispatchers.IO) { repo.fetch() }` - - 防禦性切換散落各處，漏一處就 ANR。
android/references/coroutines-lifecycle.md, line 24
- ✅ `repo.fetch()` 內部保證 main-safe，ViewModel 直接呼叫。
backend-server/references/auth-security.md, line 75
- ❌ `fetch(userProvidedUrl)` 無限制 - - 攻擊者填 metadata endpoint 拿到雲 IAM 憑證。
Show more
backend-server/references/node-ts.md, line 38
- 外部 API 回應同樣不可信：`await fetch().then(r=>r.json())` 的結果要 parse，別直接 `as`。
en/android/references/coroutines-lifecycle.md, line 23
- ❌ The ViewModel wraps every call in `withContext(Dispatchers.IO) { repo.fetch() }` - defensive switches scattered everywhere, miss one and you get an ANR.
en/android/references/coroutines-lifecycle.md, line 24
- ✅ `repo.fetch()` guarantees main-safety internally, and the ViewModel calls it directly.
en/backend-server/references/auth-security.md, line 75
- ❌ `fetch(userProvidedUrl)` with no restriction - the attacker supplies the metadata endpoint and gets the cloud IAM credentials.
en/backend-server/references/node-ts.md, line 38
- An external API response is equally untrustworthy: the result of `await fetch().then(r=>r.json())` must be parsed, don't `as` it directly.
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
backend-server/references/auth-security.md, line 43
- **禁進 git**（含 `.env` 被誤 commit） - - git 歷史永久保存，`git rm` 後歷史仍在，一旦推上遠端就當作已外洩、必須輪替。
backend-server/references/auth-security.md, line 44
- 從環境變數或 secrets manager（Vault、AWS Secrets Manager、雲 KMS）讀取；`.env` 只在本機且列入 `.gitignore`。
en/backend-server/references/auth-security.md, line 43
- **Forbidden in git** (including an accidentally committed `.env`) - git history keeps it forever, the history remains after `git rm`, and once pushed to a remote treat it as leak
Show more
en/backend-server/references/auth-security.md, line 44
- Read from environment variables or a secrets manager (Vault, AWS Secrets Manager, cloud KMS); `.env` is local-only and listed in `.gitignore`.
en/frontend-web/references/release-checklist.md, line 17
- [ ] `.env.local` is in `.gitignore`, no secret committed into git history.
en/frontend-web/references/release-checklist.md, line 55
- [ ] Production env vars (the real API URL, real keys) are set on the deploy platform - dev uses `.env.local`, the deploy platform must be set separately; forgetting it connects t
frontend-web/references/release-checklist.md, line 17
- [ ] `.env.local` 在 `.gitignore` 內，沒有 secret 被 commit 進 git 歷史。
frontend-web/references/release-checklist.md, line 55
- [ ] 上線環境變數（正式 API URL、正式金鑰）在部署平台設好 - - dev 用的是 `.env.local`，部署平台要另外設，忘了會連錯環境或 500。
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 9c7f5b7cafba. can reach a host that is not written as a fixed address. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 9c7f5b7cafba2446904a90de766cc3a6ef289c4d
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.