Grades are a hygiene check, not a security guarantee.

Claude Code, Skill

latchkey

Inject API credentials into agent requests.

Compatibility: Not stated.

Grade D

Two or more Medium findings, or a High finding. Only try it in a sandbox.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

Rescanned at commit b7f668a3ed13.

PERMISSION_SHELL_UNDECLARED INSTALL_LIFECYCLE_HOOK SECRETS_PATH_CREDENTIAL

Why this grade

  • PERMISSION_SHELL_UNDECLARED Medium

    Runs shell commands that the manifest or description does not mention.

    integrations/llm-latchkey/llm_latchkey.py, line 55 result = subprocess.run(

  • INSTALL_LIFECYCLE_HOOK Medium

    A package install hook (preinstall, install, postinstall or prepare) runs a script.

    package.json, line 38 prepare

  • SECRETS_PATH_CREDENTIAL Medium

    Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).

    scripts/cryptFile.ts, line 17 * npx tsx scripts/cryptFile.ts decrypt ~/.latchkey/credentials.json

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Concern

    requests shell access. No manifest field names shell or command execution.

    PERMISSION_SHELL_UNDECLARED

    integrations/llm-latchkey/llm_latchkey.py, line 55

    result = subprocess.run(

  • Install and update

    Concern

    runs a script at install time.

    INSTALL_LIFECYCLE_HOOK

    package.json, line 38

    prepare

  • Network

    Concern

    can reach a host that is not written as a fixed address. can reach api.github.com. The description does not name that host.

    NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

    integrations/llm-latchkey/llm_latchkey.py, line 22

    """Run a latchkey command. Latchkey injects stored API credentials into curl commands for third-party services.

    integrations/llm-latchkey/llm_latchkey.py, line 27

    - `curl <curl_arguments>` — Make an authenticated HTTP request. Pass standard curl arguments; credentials are injected automatically.

    integrations/llm-latchkey/llm_latchkey.py, line 33

    3. Use `curl <args>` to make requests — do NOT include Authorization headers, latchkey adds them.

    Show more

    integrations/llm-latchkey/llm_latchkey.py, line 42

    - `curl https://api.github.com/user`

    integrations/llm-latchkey/llm_latchkey.py, line 44

    - `curl 'https://api.linear.app/graphql' -X POST -H 'Content-Type: application/json' -d '{"query": "{ viewer { assignedIssues(first: 10) { nodes { title state { name } } } } }"}'`

    integrations/llm-latchkey/llm_latchkey.py, line 45

    - `curl 'https://discord.com/api/v10/users/@me'`

    scripts/releaseBinaries.sh, line 53

    # Usage: github_api METHOD PATH [curl args...]

    scripts/releaseBinaries.sh, line 59

    latchkey curl -sS \

  • Secrets

    Concern

    reads a credential or environment file.

    SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL

    src/playwrightUtils.ts, line 170

    if (process.env.LATCHKEY_DEBUG === '1') {

    src/playwrightUtils.ts, line 448

    if (process.env.LATCHKEY_DISABLE_SPINNER === '1') {

    scripts/cryptFile.ts, line 17

    * npx tsx scripts/cryptFile.ts decrypt ~/.latchkey/credentials.json

    Show more

    scripts/cryptFile.ts, line 18

    * npx tsx scripts/cryptFile.ts encrypt ~/.latchkey/credentials.json

    src/config.ts, line 67

    const CREDENTIAL_STORE_FILENAME = 'credentials.json.enc';

    docs/development.md, line 157

    credentials stored in `~/.latchkey/credentials.json.enc`.

    docs/development.md, line 162

    npx tsx scripts/cryptFile.ts decrypt ~/.latchkey/credentials.json.enc

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Note

    a file was over the read cap and was not fully read.

    OBFUSCATION_FILE_OVER_READ_CAP

    demo/open-code-demo-aws-s3.cast, line 1

    {"version": 2, "width": 159, "height": 37, "timestamp": 1772108843, "env": {"SHELL": "/bin/bash", "TERM": "rxvt-unicode-256color"}}

    demo/open-code-demo-slack-linear.cast, line 1

    {"version": 2, "width": 159, "height": 37, "timestamp": 1769777429, "env": {"SHELL": "/bin/bash", "TERM": "rxvt-unicode-256color"}}

    demo/pi-agent-demo-aws-s3.cast, line 1

    {"version": 2, "width": 159, "height": 37, "timestamp": 1773153137, "env": {"SHELL": "/bin/bash", "TERM": "rxvt-unicode-256color"}}

  • Licence

    Pass

    A licence file is present (LICENSE).

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit b7f668a3ed13. requests shell access. No manifest field names shell or command execution. runs a script at install time. can reach a host that is not written as a fixed address. can reach api.github.com. The description does not name that host. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked:

View source

github.com

Commit graded: b7f668a3ed136833493c8f4772af5916bade4a06

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen