Claude Code, Plugin
forge
Business model optimization for business owners and strategists.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit f6ab97f40a5a, unchanged since the check below.
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST OBFUSCATION_ENCODED_BLOB SECRETS_ENV_READ
Why this grade
- INSTALL_UNPINNED Low
Dependencies use a range or git URL with no lockfile.
package.json, line 5
resend - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
netlify/functions/dashboard-data.js, line 16
const resp = await fetch(`https://api.github.com/repos/${repo}/contents/sessions/index.json`, { - NETWORK_UNNAMED_HOST Low
Calls a fixed host that the description does not name.
netlify/functions/dashboard-data.js, line 16
const resp = await fetch(`https://api.github.com/repos/${repo}/contents/sessions/index.json`, { - OBFUSCATION_ENCODED_BLOB Low
Contains a long base64 shaped string in a file that should be readable.
examples/mechanical-magic-nexus.html, line 1609
<img src="data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4NCjxzdmcgaWQ9ImEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgdmlld0JveD0iMCAwIDgzMy43MiAy - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
netlify/functions/dashboard-data.js, line 30
const NETLIFY_ACCESS_TOKEN = process.env.NETLIFY_ACCESS_TOKEN;
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command call was found in the code. This check does not read permissions an entry declares. A permission line to write or edit files and fetch web content was found in this repository, and it may apply to this entry.
Install and update
Concern
dependencies are not pinned.
INSTALL_UNPINNED
package.json, line 5
resend
Network
Concern
can reach api.github.com. The description does not name that host. can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
netlify/functions/dashboard-data.js, line 16
const resp = await fetch(`https://api.github.com/repos/${repo}/contents/sessions/index.json`, {
netlify/functions/dashboard-data.js, line 63
const resp = await fetch(
netlify/functions/log-session.js, line 15
const resp = await fetch(`https://api.github.com/repos/${repo}/contents/${SESSIONS_PATH}`, {
Show more
netlify/functions/log-session.js, line 40
const resp = await fetch(`https://api.github.com/repos/${repo}/contents/${SESSIONS_PATH}`, {
netlify/functions/submission-created.js, line 37
const resp = await fetch(`https://api.github.com/repos/${GITHUB_WORKSHOPS_REPO}/contents/${path}`, {
CHANGELOG.md, line 292
Netlify Forms registers a form by scanning HTML at deploy time for `<form name="..." netlify>`. Added a hidden, aria-hidden form with `name="forge-intake"` + `netlify-honeypot="bot
CHANGELOG.md, line 296
`submitForm()` now also POSTs to Netlify Forms via `fetch('/', { method: 'POST', body: URLSearchParams })`. Submission is **non-blocking**: the existing `.md` download, email-to-fa
skills/intake/templates/dashboard.html, line 218
const resp = await fetch('/.netlify/functions/dashboard-data', {
Secrets
Note
reads an environment variable.
SECRETS_ENV_READ
netlify/functions/dashboard-data.js, line 30
const NETLIFY_ACCESS_TOKEN = process.env.NETLIFY_ACCESS_TOKEN;
netlify/functions/dashboard-data.js, line 88
const GITHUB_TOKEN = process.env.GITHUB_TOKEN;
netlify/functions/log-session.js, line 66
const LOG_SESSION_KEY = process.env.LOG_SESSION_KEY;
Show more
netlify/functions/log-session.js, line 76
const GITHUB_TOKEN = process.env.GITHUB_TOKEN;
netlify/functions/submission-created.js, line 27
const token = process.env.GITHUB_TOKEN;
netlify/functions/submission-created.js, line 88
if (!process.env.RESEND_API_KEY) {
netlify/functions/submission-created.js, line 93
const resend = new Resend(process.env.RESEND_API_KEY);
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains an encoded blob in a file that should be readable.
OBFUSCATION_ENCODED_BLOB
examples/mechanical-magic-nexus.html, line 1609
<img src="data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4NCjxzdmcgaWQ9ImEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgdmlld0JveD0iMCAwIDgzMy43MiAy
examples/mechanical-magic-nexus.html, line 1610
<img src="data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4NCjxzdmcgaWQ9ImEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgdmlld0JveD0iMCAwIDgzMy43MiAy
examples/mechanical-magic.html, line 1242
<img src="data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4NCjxzdmcgaWQ9ImEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgdmlld0JveD0iMCAwIDgzMy43MiAy
Show more
examples/mechanical-magic.html, line 1243
<img src="data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4NCjxzdmcgaWQ9ImEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgdmlld0JveD0iMCAwIDgzMy43MiAy
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit f6ab97f40a5a. dependencies are not pinned. can reach api.github.com. The description does not name that host. can reach a host that is not written as a fixed address. reads an environment variable. contains an encoded blob in a file that should be readable.
Date and source
Date checked:
github.com
Commit graded: f6ab97f40a5af80f0299f1406296c476621f4914
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.