Claude Code, Plugin
Innovate Or Die
Generate, attack, revise, and reality-test non-obvious solutions to difficult problems through role-separated adversarial search.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 83d89639e230, unchanged since the check below.
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED OBFUSCATION_ENCODED_BLOB
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
evals/runners/grade.py, line 150
p = subprocess.run(["claude", "-p", LLM_PROMPT.format(a=assertion, t=text[:60000]), - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
CHANGELOG.md, line 150
2026-08-20 by the Claude.ai advisory session via live fetch (HTTP 200), **not - SECRETS_PATH_UNCONFIRMED Low
The Secrets check reports a credential or environment file, but no quoted line shows a recognisable path.
.gitignore, line 1
.DS_Store - OBFUSCATION_ENCODED_BLOB Low
Contains a long base64 shaped string in a file that should be readable.
evals/transcripts/iteration-1/claude/flagship/eval-route-density/with_skill/trace/stream.jsonl, line 1
{"type":"system","subtype":"init","cwd":"/private/var/folders/REDACTED/T/iod-with_skill-87murdly","session_id":"[REDACTED-HOST-ENV]","tools":["Task","Artifact","Bash","CronCreate",
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
evals/runners/grade.py, line 150
p = subprocess.run(["claude", "-p", LLM_PROMPT.format(a=assertion, t=text[:60000]),
evals/runners/judge.py, line 30
p = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
evals/runners/judge.py, line 180
p = subprocess.run(
Show more
evals/runners/run_evals.py, line 52
p = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
evals/runners/run_evals.py, line 144
p = subprocess.run(cmd, cwd=cwd, capture_output=True, text=True, timeout=TIMEOUT_S)
evals/runners/run_evals.py, line 206
p = subprocess.run(["codex", "exec", "--skip-git-repo-check", "-s", "read-only",
evals/runners/run_evals.py, line 262
p = subprocess.run(["gemini", "-p", prompt, "-m", model, "-o", "json",
evals/runners/run_evals.py, line 380
shutil.rmtree(ws, ignore_errors=True)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
CHANGELOG.md, line 150
2026-08-20 by the Claude.ai advisory session via live fetch (HTTP 200), **not
docs/COMPATIBILITY.md, line 82
**Read 2026-08-20 by the Claude.ai advisory session via live fetch (HTTP 200);
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_UNCONFIRMED
.gitignore, line 1
.DS_Store
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains an encoded blob in a file that should be readable.
OBFUSCATION_ENCODED_BLOB
evals/transcripts/iteration-1/claude/flagship/eval-route-density/with_skill/trace/stream.jsonl, line 1
{"type":"system","subtype":"init","cwd":"/private/var/folders/REDACTED/T/iod-with_skill-87murdly","session_id":"[REDACTED-HOST-ENV]","tools":["Task","Artifact","Bash","CronCreate",
evals/transcripts/iteration-1/claude/workhorse/eval-route-density/with_skill/trace/stream.jsonl, line 1
{"type":"system","subtype":"init","cwd":"/private/var/folders/REDACTED/T/iod-with_skill-pisl1vee","session_id":"[REDACTED-HOST-ENV]","tools":["Task","Artifact","Bash","CronCreate",
evals/transcripts/iteration-1/claude/flagship/eval-route-density/with_skill/trace/stream.jsonl, line 5
{"type":"assistant","message":{"model":"claude-opus-5","id":"msg_011CeCrDMhS4wET9TPyU1mBk","type":"message","role":"assistant","content":[{"type":"thinking","thinking":"","signatur
Show more
evals/transcripts/iteration-1/claude/flagship/eval-route-density/with_skill/trace/stream.jsonl, line 11
{"type":"assistant","message":{"model":"claude-opus-5","id":"msg_011CeCrDf5T5GXpQPTx5bRDU","type":"message","role":"assistant","content":[{"type":"thinking","thinking":"","signatur
evals/transcripts/iteration-1/claude/flagship/eval-route-density/with_skill/trace/stream.jsonl, line 35
{"type":"assistant","message":{"model":"claude-opus-5","id":"msg_011CeCrE6tistQ5n6mqFrgRJ","type":"message","role":"assistant","content":[{"type":"thinking","thinking":"","signatur
evals/transcripts/iteration-1/claude/flagship/eval-route-density/with_skill/trace/stream.jsonl, line 62
{"type":"assistant","message":{"model":"claude-opus-5","id":"msg_011CeCrnKtD5TzAMFUPmzcKY","type":"message","role":"assistant","content":[{"type":"thinking","thinking":"","signatur
evals/transcripts/iteration-1/claude/flagship/eval-route-density/with_skill/trace/stream.jsonl, line 84
{"type":"assistant","message":{"model":"claude-opus-5","id":"msg_011CeCsTcDJoKJiwK4Sq9pDV","type":"message","role":"assistant","content":[{"type":"thinking","thinking":"","signatur
evals/transcripts/iteration-1/claude/flagship/eval-route-density/with_skill/trace/stream.jsonl, line 94
{"type":"assistant","message":{"model":"claude-opus-5","id":"msg_011CeCsUM7jxMqWrPmiNUQiq","type":"message","role":"assistant","content":[{"type":"thinking","thinking":"","signatur
evals/transcripts/iteration-1/claude/flagship/eval-route-density/with_skill/trace/stream.jsonl, line 182
{"type":"assistant","message":{"model":"claude-opus-5","id":"msg_011CeCsUmp3QuPzyDShuvVTJ","type":"message","role":"assistant","content":[{"type":"thinking","thinking":"","signatur
evals/transcripts/iteration-1/claude/flagship/eval-route-density/with_skill/trace/stream.jsonl, line 225
{"type":"assistant","message":{"model":"claude-opus-5","id":"msg_011CeCsxC7XsSTaNBRz1tR1e","type":"message","role":"assistant","content":[{"type":"thinking","thinking":"","signatur
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 83d89639e230. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. contains an encoded blob in a file that should be readable.
Date and source
Date checked:
github.com
Commit graded: 83d89639e23019a574fbc88f3c4369ea960b687c
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.