Grades are a hygiene check, not a security guarantee.

Claude Code, Skill

Idea To Blueprint

Turn a raw product, app, bot or feature idea (even 2, 3 lines) into ONE self-sufficient, evidence-backed build blueprint (.md, often 100 pages) that Claude Code or Codex executes one epic per fresh session without guessing.

Compatibility: Not stated.

Grade B

Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

SECRETS_PATH_DOTENV PERMISSION_SHELL_DECLARED OBFUSCATION_FILE_OVER_READ_CAP

Why this grade

  • SECRETS_PATH_DOTENV Low

    Mentions a .env file.

    examples/telegram-invoice-bot/AGENTS.md, line 31 - Dev server: `npm run dev` (needs Docker Postgres and a local `.env`)

  • PERMISSION_SHELL_DECLARED Note

    Runs shell commands, and the manifest or description says so.

    examples/telegram-invoice-bot/BLUEPRINT.md, line 2792 - Integration: `test/arch/gate.int.test.ts` - creates temporary fixture files in a temp copy of the repo (via `fs.cp` to `os.tmpdir()`), runs each gate script with `execa`-free `ch

  • OBFUSCATION_FILE_OVER_READ_CAP Note

    A file was over the read cap and was not fully read.

    examples/telegram-invoice-bot/BLUEPRINT.md, line 1 # InvoiceNudge - Build Blueprint

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Note

    requests shell access. The manifest names this permission.

    PERMISSION_SHELL_DECLARED

    examples/telegram-invoice-bot/BLUEPRINT.md, line 2792

    - Integration: `test/arch/gate.int.test.ts` - creates temporary fixture files in a temp copy of the repo (via `fs.cp` to `os.tmpdir()`), runs each gate script with `execa`-free `ch

  • Install and update

    Pass

    No install-time script found, and dependencies are pinned or absent.

  • Network

    Pass

    No network call found.

  • Secrets

    Concern

    reads a credential or environment file.

    SECRETS_PATH_DOTENV

    examples/telegram-invoice-bot/AGENTS.md, line 31

    - Dev server: `npm run dev` (needs Docker Postgres and a local `.env`)

    examples/telegram-invoice-bot/BLUEPRINT.md, line 2172

    ├── .env.example # every variable in §12.8 with a one-line meaning

    examples/telegram-invoice-bot/BLUEPRINT.md, line 2752

    **Scope** - In: `package.json` with exact pins, `package-lock.json`, `.node-version`, `tsconfig*.json`, empty source tree per §13.3, `docs/BLUEPRINT.md` (this file), `docs/PROGRESS

    Show more

    examples/telegram-invoice-bot/BLUEPRINT.md, line 2758

    - AC-5 (env template) Given `.env.example`, Then it lists every variable of §12.8 exactly once, each with a one-line comment, and no values other than obvious non-secret examples.

    examples/telegram-invoice-bot/BLUEPRINT.md, line 2762

    **Edge cases** - EC-SEC-05 (no secret values in `.env.example`, checked by gitleaks in E00-S02); story-specific: a package whose latest version on install day differs from §13.1 →

    examples/telegram-invoice-bot/BLUEPRINT.md, line 2765

    - Unit: `test/arch/docs-present.test.ts` - AGENTS/CLAUDE identical, checklist present, DR headings present, `.env.example` variables equal the §12.8 table - covers AC-4, AC-5.

    examples/telegram-invoice-bot/BLUEPRINT.md, line 4145

    AGENTS.md / CLAUDE.md identical entry points (Appendix B)

    examples/telegram-invoice-bot/BLUEPRINT.md, line 4630

    E00-S01 copies these files literally, so it doesn't invent them. In the repository, `BLUEPRINT.md`, `PROGRESS.md`, `DECISIONS.md` and `REVIEW-CHECKLIST.md` live under `docs/`; `AGE

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Note

    a file was over the read cap and was not fully read.

    OBFUSCATION_FILE_OVER_READ_CAP

    examples/telegram-invoice-bot/BLUEPRINT.md, line 1

    # InvoiceNudge - Build Blueprint

  • Licence

    Pass

    A licence file is present (LICENSE).

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 38cbec9a8611. requests shell access. The manifest names this permission. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked:

View source

github.com

Commit graded: 38cbec9a8611bc687a89fcc4eb90897a5a2655ae

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen