Claude Code, Skill
Heya Skill
把新闻、产品发布、争议事件、游戏资讯或合集素材，改写成 B 站创作者「黑鸦」风格的视频标题 — 长标题、强情绪、多事件合并、实体密集。
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_FILE_OVER_READ_CAP
Why this grade
- INSTALL_UNPINNED Low
Dependencies use a range or git URL with no lockfile.
package.json, line 14
uapi-sdk-typescript - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
.github/workflows/update-reference.yml, line 35
bun -e 'const url = process.env.HANLP_URL; if (!url) throw new Error("HANLP_URL secret is required for analysis"); const base = url.replace(/\/+$/, ""); const response = await fetc - SECRETS_PATH_DOTENV Low
Mentions a .env file.
AGENTS.md, line 57
Copy `.env.example` to `.env` (gitignored), and start a local HanLP REST service before running analysis. Pipeline performs `/health` check and fails clearly if HanLP unavailable. - OBFUSCATION_FILE_OVER_READ_CAP Note
A file was over the read cap and was not fully read.
skills/heya-title-style/references/03-title-features.json, line 1
[
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Concern
dependencies are not pinned.
INSTALL_UNPINNED
package.json, line 14
uapi-sdk-typescript
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
.github/workflows/update-reference.yml, line 35
bun -e 'const url = process.env.HANLP_URL; if (!url) throw new Error("HANLP_URL secret is required for analysis"); const base = url.replace(/\/+$/, ""); const response = await fetc
AGENTS.md, line 28
3 phases: fetch (UApi Bilibili proxy) → analyze (HanLP REST + deterministic aggregation) → generate (template substitution).
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
.gitignore, line 1
node_modules/
AGENTS.md, line 57
Copy `.env.example` to `.env` (gitignored), and start a local HanLP REST service before running analysis. Pipeline performs `/health` check and fails clearly if HanLP unavailable.
CONTRIBUTING.md, line 9
cp .env.example .env
Show more
CONTRIBUTING.md, line 12
编辑 `.env` 填入实际值。完整 pipeline 需要本地 HanLP REST 服务（默认 `http://127.0.0.1:8765`）；只改代码、文档或测试时不需要启动 HanLP。
CONTRIBUTING.md, line 63
└── .env.example
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read.
OBFUSCATION_FILE_OVER_READ_CAP
skills/heya-title-style/references/03-title-features.json, line 1
[
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 424d3dcd27ac. dependencies are not pinned. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read.
Date and source
Date checked:
github.com
Commit graded: 424d3dcd27ac6651d9270aa209d0bbebf47fd8e6
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.