Grades are a hygiene check, not a security guarantee.

Claude Code, Skill

My Skills

My personal AI agent skills — managed and synced with skillshare.

Compatibility: Not stated.

Grade D

Two or more Medium findings, or a High finding. Only try it in a sandbox.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

Rescanned at commit 04bd97462804.

SECRETS_PATH_CREDENTIAL OBFUSCATION_ENCODED_BLOB OBFUSCATION_MINIFIED_PAYLOAD

Why this grade

  • SECRETS_PATH_CREDENTIAL Medium

    Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).

    archify/explainer/sources.mjs, line 14 const SECRET_NAME = /^(?:\.env(?:\..*)?|\.npmrc|\.netrc|\.pypirc|\.(?:

  • OBFUSCATION_ENCODED_BLOB Medium

    Contains a long base64 shaped string in a file that should be readable.

    archify/assets/template.html, line 1 <!DOCTYPE html>

  • OBFUSCATION_MINIFIED_PAYLOAD Medium

    Contains a very long line with almost no spaces in a script or style file.

    archify/assets/template.html, line 1 <!DOCTYPE html>

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Concern

    can delete files.

    PERMISSION_DELETE_FILES

    archify/explainer/check.mjs, line 159

    } finally {fs.rmSync(directory,{recursive:true,force:true});}

    archify/renderers/shared/atomic-output.mjs, line 793

    fs.unlinkSync(quarantineFile);

    archify/renderers/shared/atomic-output.mjs, line 871

    fs.unlinkSync(quarantineFile);

    Show more

    archify/renderers/shared/owned-temp-directory.mjs, line 59

    fs.rmSync(directory, { recursive: true, force: false, maxRetries: 0 });

    archify/renderers/shared/path-semantics.mjs, line 317

    fs.unlinkSync(quarantinePath);

    archify/scripts/check-update.mjs, line 650

    mutate: () => fs.rm(resolved, options),

  • Install and update

    Note

    The docs document an installer that pipes a download into a shell.

    INSTALL_DOCUMENTED_INSTALLER

    README.md, line 13

    curl -fsSL https://raw.githubusercontent.com/runkids/skillshare/main/install.sh | sh

  • Network

    Concern

    can reach a host that is not written as a fixed address. can reach api.github.com. The description does not name that host.

    NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

    frontend/react-best-practices/AGENTS.md, line 945

    const fontData = await fetch(

    frontend/react-best-practices/AGENTS.md, line 949

    const logoData = await fetch(

    frontend/react-best-practices/AGENTS.md, line 970

    const fontData = fetch(

    Show more

    frontend/react-best-practices/AGENTS.md, line 974

    const logoData = fetch(

    frontend/react-best-practices/AGENTS.md, line 1498

    fetch('/api/users')

    frontend/react-doctor/SKILL.md, line 36

    curl --fail --silent --show-error \

    skillshare/scripts/run.sh, line 71

    LATEST=$(curl -sL "https://api.github.com/repos/${REPO}/releases/latest" | grep '"tag_name"' | cut -d'"' -f4)

    skillshare/scripts/run.sh, line 93

    if ! curl -sL "$URL" | tar xz -C "$TMP_DIR" 2>/dev/null; then

  • Secrets

    Concern

    reads a credential or environment file.

    SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

    archify/explainer/sources.mjs, line 17

    const ENVIRONMENT_REFERENCE = /^(?:\$(?:[A-Za-z_][\w]*|\{[A-Za-z_][\w]*\})|(?:process\.env|os\.environ|env)(?:\.[A-Za-z_][\w]*|\[['"][A-Za-z_][\w]*['"]\])|(?:os\.getenv|getenv|env)

    archify/explainer/sources.mjs, line 14

    const SECRET_NAME = /^(?:\.env(?:\..*)?|\.npmrc|\.netrc|\.pypirc|\.(?:

    agents-context-router/evals/fixtures/routed/AGENTS.md, line 19

    - Never commit secrets. `.env` stays local.

    Show more

    agents-context-router/evals/fixtures/tidepool/AGENTS.md, line 21

    - Never commit secrets. `.env` stays local.

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Concern

    contains an encoded blob in a file that should be readable. contains a minified payload.

    OBFUSCATION_ENCODED_BLOB OBFUSCATION_MINIFIED_PAYLOAD

    archify/assets/template.html, line 1

    <!DOCTYPE html>

    archify/bin/archify.mjs, line 1

    #!/usr/bin/env node

    archify/delta/architecture-delta.mjs, line 782

    .review-strip{display:grid;grid-template-columns:auto auto auto auto minmax(0,1fr);align-items:center;gap:5px;margin:0 0 10px;padding:7px 8px;border-block:1px solid var(--d-line);f

    Show more

    archify/delta/architecture-delta.mjs, line 783

    .canvas{overflow:hidden;border:1px solid var(--d-line);border-radius:10px;background:#09141e;padding:12px;min-height:520px}.canvas svg{display:block;width:100%;height:auto;max-heig

    archify/delta/architecture-delta.mjs, line 784

    rect[data-graph-role="structural-frame"][data-delta-state="added"]{stroke:var(--d-add)!important;stroke-width:2.5!important}rect[data-graph-role="structural-frame"][data-delta-stat

    archify/delta/architecture-delta.mjs, line 786

    html[data-theme="dark"] body{background:#071019!important;background-image:none!important}html[data-theme="light"]{color-scheme:light;--d-ink:#10283c;--d-muted:#587187;--d-line:#c8

    archify/delta/architecture-delta.mjs, line 787

    @media(max-width:760px){.proof-page{width:100%;padding:12px}.proof-head{grid-template-columns:1fr;gap:14px;align-items:start}.proof-head h1{font-size:32px}.metrics{display:grid;gri

    archify/delta/architecture-delta.mjs, line 788

    @media(prefers-reduced-motion:reduce){*{scroll-behavior:auto!important}.canvas[data-delta-review-active] [data-delta-review-current]{transition:none!important}}@media print{body{mi

    archify/examples/class-payment-processors-rendered.html, line 1

    <!DOCTYPE html>

    archify/examples/class-payments-rendered.html, line 1

    <!DOCTYPE html>

    archify/examples/dataflow-product-analytics.html, line 1

    <!DOCTYPE html>

    archify/examples/erd-orders-rendered.html, line 1

    <!DOCTYPE html>

    archify/examples/lifecycle-agent-run.html, line 1

    <!DOCTYPE html>

    archify/examples/sequence-cache-miss-request.html, line 1

    <!DOCTYPE html>

    archify/explainer/browser-check.mjs, line 23

    return {component:block.id,minimum,body,ratio:minimum===null?null:minimum/body,smallest:texts.find(t=>t.size===minimum),rect:{width:svgBounds.width,height:svgBounds.height},compute

    archify/explainer/browser-check.mjs, line 49

    const localClipping=(nativeClipping?regions:[]).filter(e=>{const entry=intersections.get(e),r=entry.boundingClientRect,i=entry.intersectionRect;const style=getComputedStyle(e),ownC

  • Licence

    Note

    no licence file found.

    LICENCE_MISSING

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 04bd97462804. can delete files. can reach a host that is not written as a fixed address. can reach api.github.com. The description does not name that host. reads a credential or environment file. contains an encoded blob in a file that should be readable. contains a minified payload. no licence file found.

Date and source

Date checked:

View source

github.com

Commit graded: 04bd974628046bb76c4aae5cf75ccc788fb8bdc3

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen