Claude Code, Skill
Mastery Tutor
A local-first mastery tutor for AI agents.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
NETWORK_HOST_FROM_INPUT
Why this grade
- NETWORK_HOST_FROM_INPUT Medium
A file takes a URL or endpoint as input and has no fixed host list.
plugins/mastery-tutor/skills/mastery-tool-creator/scripts/validate_tool.py, line 71
(re.compile(r"\bfetch\s*\("), "fetch()"),
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
install-agent-skills.py, line 254
shutil.rmtree(stage)
install_transaction.py, line 166
shutil.rmtree(staged)
plugins/mastery-tutor/skills/mastery-coach/scripts/mastery.py, line 1811
shutil.rmtree(tombstone)
Show more
plugins/mastery-tutor/skills/mastery-tool-creator/scripts/tool_scaffold.py, line 316
shutil.rmtree(temporary_dir)
plugins/mastery-tutor/skills/mastery-tool-creator/scripts/tool_scaffold.py, line 318
shutil.rmtree(tool_dir)
quality/build_adapters.py, line 138
shutil.rmtree(backup_root, ignore_errors=True)
quality/release_audit.py, line 43
completed = subprocess.run(
quality/test_agent_skill_distribution.py, line 24
completed = subprocess.run(
quality/test_agent_skill_distribution.py, line 87
shutil.rmtree(creator)
quality/test_agent_skill_distribution.py, line 171
completed = subprocess.run(
quality/test_eval_contract.py, line 333
strict = subprocess.run(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE, check=False)
quality/test_eval_contract.py, line 334
incomplete = subprocess.run(
quality/test_eval_contract.py, line 362
invalid = subprocess.run(
quality/test_eval_contract.py, line 368
valid = subprocess.run(
quality/test_html_classroom_v6.py, line 27
result = subprocess.run(
skills/mastery-coach/scripts/mastery.py, line 1811
shutil.rmtree(tombstone)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Serious
accepts a host from input, with no fixed list in this file.
NETWORK_HOST_FROM_INPUT
plugins/mastery-tutor/skills/mastery-tool-creator/scripts/validate_tool.py, line 71
(re.compile(r"\bfetch\s*\("), "fetch()"),
quality/test_preview_contract.py, line 29
for forbidden in ['fetch(', 'XMLHttpRequest', 'localStorage', 'sendBeacon', 'innerHTML']:
quality/test_tool_contract_v4.py, line 574
helper.write_text("fetch('https://example.com/data.json');\n", encoding="utf-8")
Show more
quality/test_tool_contract_v4.py, line 576
self.assertIn("fetch()", "\n".join(external_js["errors"]))
skills/mastery-tool-creator/scripts/validate_tool.py, line 71
(re.compile(r"\bfetch\s*\("), "fetch()"),
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_UNCONFIRMED
.gitignore, line 31
# env files (can opt-in for committing if needed)
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 33d811c5e03c. can delete files. accepts a host from input, with no fixed list in this file. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 33d811c5e03ccf868b2007644c8efd74a675c8e7
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.