Claude Code, Skill
genesis
Three modes for Claude Code projects: create a new one from an empty folder (research and design before stack, then build and test it), transition an existing repository to a stated standard, and check the user-level ~/.claude layer that loads in every session.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit a21d46ade1c3, unchanged since the check below.
SECRETS_PATH_CREDENTIAL
Why this grade
- SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
skills/genesis/reference.md, line 63
"denyRead": ["~/.ssh", "~/.aws", "~/.gnupg", "~/.config/gh", "~/.netrc", "~/.npmrc", "~/.config/git"]
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
hooks/stop-acceptance.mjs, line 59
try { fs.unlinkSync(blocksFile); } catch { /* absent → nothing to reset */ }
templates/todo-archive-reminder.mjs, line 154
if (prev === sig && fresh) { fs.unlinkSync(marker); process.exit(0); } // already nudged this exact set
templates/user-layer/hooks/context-reground.mjs, line 67
try { if (Date.now() - fs.statSync(path.join(dir, f)).mtimeMs > 7 * 86_400_000) fs.unlinkSync(path.join(dir, f)); } catch { /* ignore */ }
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Pass
No network call found.
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/gate.sh, line 117
# No shipped deny rule may swallow `.env.example`. It is the one committed env file, it holds names with
scripts/gate.sh, line 119
# `.env.*` glob makes the file the build must maintain unreadable, and since Claude Code 2.1.208 uneditable
skills/genesis/reference.md, line 63
"denyRead": ["~/.ssh", "~/.aws", "~/.gnupg", "~/.config/gh", "~/.netrc", "~/.npmrc", "~/.config/git"]
Show more
scripts/gate.sh, line 124
targets = ['.env.example', '.env.production.example']
scripts/gate.sh, line 138
print(" ok no deny rule swallows .env.example" if not bad else "")
skills/generate-pr/SKILL.md, line 207
git diff --name-only "$TARGET...HEAD" | grep -qxE '\.env(\..*)?' && { echo "ABORT: .env in diff"; exit 1; }
skills/git-commit/SKILL.md, line 83
git diff --staged --name-only | grep -E '(^|/)\.env($|\.)' | grep -vE '\.(example|template|sample)$' \
.claude/settings.json, line 5
"Read(./.env)",
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit a21d46ade1c3. can delete files. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: a21d46ade1c3034740bfbf9f204f56bcdf52647a
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.