Claude Code, Skill
Glad Personal
A ready-made, tested set of agent skills for Claude Code. It has the skills I wrote and use every day, plus a vetted catalog of the best third-party skills and plugins, each linked to its original author.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
INSTALL_REMOTE_SCRIPT
Why this grade
- INSTALL_REMOTE_SCRIPT Medium
Fetches a script from the network and runs it (a pipe to a shell, or an install hook with a URL).
install.sh, line 36
curl -fsSL https://raw.githubusercontent.com/Gladiarn/Glad-Personal/main/install.sh | bash -s -- --all
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Serious
install fetches a script from the network. README documents an installer that pipes a download into a shell.
INSTALL_REMOTE_SCRIPT INSTALL_DOCUMENTED_INSTALLER
README.md, line 69
curl -fsSL https://raw.githubusercontent.com/Gladiarn/Glad-Personal/main/install.sh | bash -s -- --all
install.sh, line 36
curl -fsSL https://raw.githubusercontent.com/Gladiarn/Glad-Personal/main/install.sh | bash -s -- --all
catalog/README.md, line 62
n_resumer) · see repo | ⚪ not vetted | `curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/cross_agent_session_resumer/main/install.sh \| bash` | Not in the skills dire
Show more
catalog/README.md, line 63
ss_triage) · see repo | ⚪ not vetted | `curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/process_triage/main/install.sh \| bash` | Not in the skills directory: its ow
skills/glad-personal/references/stack.json, line 228
"install": "curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/cross_agent_session_resumer/main/install.sh | bash",
skills/glad-personal/references/stack.json, line 240
"install": "curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/process_triage/main/install.sh | bash",
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
install.sh, line 66
curl -fsSL "$RAW_STACK" -o "$STACK_FILE"
skills/glad-frontend/SKILL.md, line 60
const res = await fetch(`/api/markets?${toQuery(filters)}`)
skills/glad-frontend/SKILL.md, line 65
const res = await fetch(`/api/markets/${id}`)
Show more
skills/glad-frontend/SKILL.md, line 131
| Repository interface skipped, `fetch()` called straight from mock mode with a hardcoded mock response inline | No real swap point exists - "temporary" mock logic ends up scattere
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
catalog/README.md, line 28
| **scroll-craft** | Premium scroll-driven landing pages: journey and page grammar, dimensional heroes, one signature move, and screenshot-verified desktop, mobile and reduced-moti
skills/glad-personal/references/stack.json, line 63
"notes": "Verification needs ffmpeg, Chrome and `npm i playwright-core` in the build project; it drives headless Chromium with a fresh profile against localhost only, not your own
skills/opus-plan-sonnet-build/evals/trigger-prompts.tsv, line 8
N3 no Change the port in .env.example from 3000 to 4000.
Show more
skills/opus-plan-sonnet-build/evals/trigger-prompts.tsv, line 14
H4 no Add .env.local to the .gitignore.
skills/production-readiness/checklist.md, line 39
- ⛔ Secrets not in git → `git ls-files | grep -iE '\.env|secret|key'`; `git log -p -S 'BEGIN PRIVATE KEY' --all | head` (count only)
skills/production-readiness/examples/sample-report.md, line 20
| Secrets not in git | PASS | `git ls-files` → only `.env.example`; no key material in history | VERIFIED |
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 02f7458a5607. install fetches a script from the network. README documents an installer that pipes a download into a shell. can reach a host that is not written as a fixed address. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 02f7458a56079bc691f2b14a7fed7b9b571c70db
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.