Grades are a hygiene check, not a security guarantee.

Claude Code, Plugin

Neurise Adseo

Kompleksowy pipeline AI marketingu: research (Agent Reach) -> strategia i copy (56 agentów marketingowych) -> media -> publikacja (Postiz).

Compatibility: Not stated.

Grade D

Two or more Medium findings, or a High finding. Only try it in a sandbox.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

Rescanned at commit 65a04180ff37, unchanged since the check below.

Pattern found, check before installing

The checks matched a pattern that needs a closer look. It does not mean the code is harmful. Read the quoted lines below.

  • NETWORK_HOST_FROM_INPUT High

    host from input plus a credential path in operative code

INSTALL_REMOTE_SCRIPT NETWORK_HOST_FROM_INPUT PERMISSION_SHELL_UNDECLARED SECRETS_PATH_CREDENTIAL

Why this grade

  • INSTALL_REMOTE_SCRIPT High

    Fetches a script from the network and runs it (a pipe to a shell, or an install hook with a URL).

    plugins/neurise-blog/CLAUDE.md, line 163 curl -sL https://neurise.io | bash

  • NETWORK_HOST_FROM_INPUT High

    A file takes a URL or endpoint as input and has no fixed host list.

    agents/marketing-agentic-search-optimizer.md, line 147 const response = await fetch('/api/bookings', {

  • PERMISSION_SHELL_UNDECLARED Medium

    Runs shell commands that the manifest or description does not mention.

    plugins/neuRysiek-skills/skillopt/generate_questions.py, line 69 proc = subprocess.run([CLAUDE_BIN, "--print", "--model", GEN_MODEL, prompt],

  • SECRETS_PATH_CREDENTIAL Medium

    Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).

    plugins/neuRysiek-skills/scripts/rewrite-orthogonal-skills.js, line 103 Read your credentials from ~/.gooseworks/credentials.json:

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

If you think this grade is wrong, email [email protected] with the entry link and your evidence. We aim to acknowledge within two working days and decide within seven. If we confirm an error, we aim to correct it within 24 hours of confirming it. These are aims, not guarantees.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Concern

    requests shell access. No manifest field names shell or command execution. can delete files.

    PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES

    plugins/neuRysiek-skills/skillopt/generate_questions.py, line 69

    proc = subprocess.run([CLAUDE_BIN, "--print", "--model", GEN_MODEL, prompt],

    plugins/neuRysiek-skills/skillopt/report.py, line 236

    os.system(f'open "{out}"' if sys.platform == "darwin" else f'xdg-open "{out}"')

    plugins/neuRysiek-skills/skillopt/run_batch.py, line 70

    proc = subprocess.run(cmd, capture_output=True, text=True)

    Show more

    plugins/neuRysiek-skills/skillopt/run_batch.py, line 105

    shutil.rmtree(out_dir, ignore_errors=True)

    plugins/neuRysiek-skills/skillopt/envs/meta_ads_analyzer/adapter.py, line 90

    proc = subprocess.run(_sandbox_wrap(cmd, workdir), cwd=workdir, capture_output=True, text=True, timeout=timeout)

    plugins/neuRysiek-skills/skillopt/envs/meta_ads_analyzer/adapter.py, line 160

    proc = subprocess.run(run_cmd, input=judge_prompt, capture_output=True, text=True,

    plugins/neuRysiek-skills/skills/ads/capabilities/create-music-elevenlabs/scripts/gen_music.py, line 20

    subprocess.run(["ffmpeg", "-y", "-hide_banner", "-loglevel", "error", "-ss", str(a.trim_intro),

    plugins/neuRysiek-skills/skills/ads/capabilities/render-3d-character-explainer/scripts/compose.py, line 51

    r = subprocess.run(cmd, capture_output=True, text=True)

  • Install and update

    Serious

    install fetches a script from the network.

    INSTALL_REMOTE_SCRIPT

    plugins/neurise-blog/CLAUDE.md, line 163

    curl -sL https://neurise.io | bash

    plugins/neurise-blog/docs/INSTALLATION.md, line 25

    curl -sL https://neurise.io | bash

    plugins/neurise-seo/docs/INSTALLATION.md, line 136

    curl -fsSL https://neurise.io | bash

    Show more

    plugins/neurise-seo/docs/INSTALLATION.md, line 139

    curl -fsSL https://neurise.io | bash

    plugins/neurise-seo/docs/MIGRATION-v1-to-v2.md, line 165

    curl -fsSL https://neurise.io | bash

    plugins/neurise-seo/docs/TROUBLESHOOTING.md, line 32

    curl -fsSL https://neurise.io | bash

    plugins/neurise-seo/extensions/ahrefs/install.sh, line 27

    echo " Install it first: curl -fsSL https://raw.githubusercontent.com/AgriciDaniel/claude-seo/main/install.sh | bash"

    plugins/neurise-seo/extensions/banana/install.sh, line 22

    echo " Install it first: curl -fsSL https://raw.githubusercontent.com/AgriciDaniel/claude-seo/main/install.sh | bash"

    plugins/neurise-seo/extensions/dataforseo/install.sh, line 35

    echo " Install it first: curl -fsSL https://raw.githubusercontent.com/AgriciDaniel/claude-seo/main/install.sh | bash"

    plugins/neurise-seo/extensions/firecrawl/install.sh, line 22

    echo " Install it first: curl -fsSL https://raw.githubusercontent.com/AgriciDaniel/claude-seo/main/install.sh | bash"

    plugins/neurise-web/skills/neuriseweb/interaction-skills/profile-sync.md, line 8

    curl -fsSL https://browser-use.com/profile.sh | sh

  • Network

    Serious

    accepts a host from input, with no fixed list in this file.

    NETWORK_HOST_FROM_INPUT

    agents/marketing-agentic-search-optimizer.md, line 147

    const response = await fetch('/api/bookings', {

    agents/marketing-multi-platform-publisher.md, line 107

    curl -X POST http://localhost:18060/api/v1/publish \

    plugins/neuRysiek-skills/bin/goose-skills.js, line 28

    function fetch(url) {

    Show more

    plugins/neuRysiek-skills/bin/goose-skills.js, line 31

    https.get(u, { headers: { 'User-Agent': 'goose-skills-cli' } }, (res) => {

    plugins/neuRysiek-skills/bin/goose-skills.js, line 51

    const data = await fetch(INDEX_URL);

    plugins/neuRysiek-skills/bin/goose-skills.js, line 86

    const content = await fetch(url);

    plugins/neuRysiek-skills/bin/goose-skills.js, line 106

    const content = await fetch(url);

    plugins/neuRysiek-skills/bin/goose-skills.js, line 129

    sharedContents[path.basename(sharedPath)] = await fetch(url);

    plugins/neuRysiek-skills/scripts/rewrite-orthogonal-skills.js, line 162

    * Rewrite a single `orth run ...` command to a curl call.

    plugins/neuRysiek-skills/skills/ads/capabilities/create-image-fal/scripts/media_proxy.py, line 54

    sub = requests.post(f"{base}/{model_path}", params=params, json=payload, timeout=120).json()

    plugins/neuRysiek-skills/skills/ads/capabilities/create-image-fal/scripts/media_proxy.py, line 61

    st = requests.get(status_url, params=params, timeout=60).json()

    plugins/neuRysiek-skills/skills/ads/capabilities/create-image-fal/scripts/media_proxy.py, line 64

    return requests.get(response_url, params=params, timeout=120).json()

    plugins/neuRysiek-skills/skills/ads/capabilities/create-image-fal/scripts/media_proxy.py, line 86

    r = requests.post(url, params=_params(tok, agent), timeout=timeout_s,

    plugins/neuRysiek-skills/skills/ads/capabilities/create-image-fal/scripts/media_proxy.py, line 104

    r = requests.post(url, params=_params(tok, agent), timeout=timeout_s,

    plugins/neuRysiek-skills/skills/ads/capabilities/create-music-elevenlabs/scripts/media_proxy.py, line 54

    sub = requests.post(f"{base}/{model_path}", params=params, json=payload, timeout=120).json()

    plugins/neuRysiek-skills/skills/ads/capabilities/create-music-elevenlabs/scripts/media_proxy.py, line 61

    st = requests.get(status_url, params=params, timeout=60).json()

    plugins/neuRysiek-skills/skills/ads/capabilities/create-music-elevenlabs/scripts/media_proxy.py, line 64

    return requests.get(response_url, params=params, timeout=120).json()

    plugins/neuRysiek-skills/skills/ads/capabilities/create-music-elevenlabs/scripts/media_proxy.py, line 86

    r = requests.post(url, params=_params(tok, agent), timeout=timeout_s,

    plugins/neuRysiek-skills/skills/ads/capabilities/create-music-elevenlabs/scripts/media_proxy.py, line 104

    r = requests.post(url, params=_params(tok, agent), timeout=timeout_s,

    plugins/neuRysiek-skills/skills/ads/capabilities/create-video-fal/scripts/media_proxy.py, line 54

    sub = requests.post(f"{base}/{model_path}", params=params, json=payload, timeout=120).json()

    plugins/neuRysiek-skills/skills/ads/capabilities/create-video-fal/scripts/media_proxy.py, line 61

    st = requests.get(status_url, params=params, timeout=60).json()

    plugins/neuRysiek-skills/skills/ads/capabilities/create-video-fal/scripts/media_proxy.py, line 64

    return requests.get(response_url, params=params, timeout=120).json()

    plugins/neuRysiek-skills/skills/ads/capabilities/create-video-fal/scripts/media_proxy.py, line 86

    r = requests.post(url, params=_params(tok, agent), timeout=timeout_s,

    plugins/neuRysiek-skills/skills/ads/capabilities/create-video-fal/scripts/media_proxy.py, line 104

    r = requests.post(url, params=_params(tok, agent), timeout=timeout_s,

    plugins/neuRysiek-skills/skills/ads/capabilities/create-vo-elevenlabs/scripts/media_proxy.py, line 54

    sub = requests.post(f"{base}/{model_path}", params=params, json=payload, timeout=120).json()

    plugins/neuRysiek-skills/skills/ads/capabilities/create-vo-elevenlabs/scripts/media_proxy.py, line 61

    st = requests.get(status_url, params=params, timeout=60).json()

    plugins/neuRysiek-skills/skills/ads/capabilities/create-vo-elevenlabs/scripts/media_proxy.py, line 64

    return requests.get(response_url, params=params, timeout=120).json()

    plugins/neuRysiek-skills/skills/ads/capabilities/create-vo-elevenlabs/scripts/media_proxy.py, line 86

    r = requests.post(url, params=_params(tok, agent), timeout=timeout_s,

    plugins/neuRysiek-skills/skills/ads/capabilities/create-vo-elevenlabs/scripts/media_proxy.py, line 104

    r = requests.post(url, params=_params(tok, agent), timeout=timeout_s,

    plugins/neuRysiek-skills/skills/ads/capabilities/media-proxy/scripts/media_proxy.py, line 54

    sub = requests.post(f"{base}/{model_path}", params=params, json=payload, timeout=120).json()

    plugins/neuRysiek-skills/skills/ads/capabilities/media-proxy/scripts/media_proxy.py, line 61

    st = requests.get(status_url, params=params, timeout=60).json()

    plugins/neuRysiek-skills/skills/ads/capabilities/media-proxy/scripts/media_proxy.py, line 64

    return requests.get(response_url, params=params, timeout=120).json()

    plugins/neuRysiek-skills/skills/ads/capabilities/media-proxy/scripts/media_proxy.py, line 101

    r = requests.post(url, params=_params(tok, agent), timeout=timeout_s,

    plugins/neuRysiek-skills/skills/ads/capabilities/media-proxy/scripts/media_proxy.py, line 119

    r = requests.post(url, params=_params(tok, agent), timeout=timeout_s,

  • Secrets

    Concern

    reads a credential or environment file.

    SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

    plugins/neuRysiek-skills/scripts/rewrite-orthogonal-skills.js, line 103

    Read your credentials from ~/.gooseworks/credentials.json:

    plugins/neuRysiek-skills/scripts/rewrite-orthogonal-skills.js, line 105

    export GOOSEWORKS_API_KEY=$(python3 -c "import json;print(json.load(open('$HOME/.gooseworks/credentials.json'))['api_key'])")

    plugins/neuRysiek-skills/scripts/rewrite-orthogonal-skills.js, line 106

    export GOOSEWORKS_API_BASE=$(python3 -c "import json;print(json.load(open('$HOME/.gooseworks/credentials.json')).get('api_base','https://api.gooseworks.ai'))")

    Show more

    plugins/neuRysiek-skills/scripts/rewrite-orthogonal-skills.js, line 109

    If ~/.gooseworks/credentials.json does not exist, tell the user to run: \`npx gooseworks login\`

    plugins/neuRysiek-skills/skillopt/setup.sh, line 41

    echo " 2. (Optional) real Meta data -> put META_ADS_TOKEN in goose-skills/.env"

    plugins/neuRysiek-skills/skills/ads/capabilities/create-image-fal/scripts/media_proxy.py, line 10

    credits. Credentials load from ~/.gooseworks/credentials.json (the CLI writes it).

    plugins/neuRysiek-skills/skills/ads/capabilities/create-image-fal/scripts/media_proxy.py, line 31

    p = pathlib.Path(os.path.expanduser("~/.gooseworks/credentials.json"))

    plugins/neuRysiek-skills/skills/ads/capabilities/create-image-gpt-image-fal/SKILL.md, line 47

    test -n "$FAL_API_KEY" || test -n "$FAL_KEY" || { echo "Missing FAL_API_KEY / FAL_KEY in .env"; exit 1; }

    plugins/neuRysiek-skills/skills/ads/capabilities/google-ad-scraper/scripts/search_google_ads.py, line 25

    GOOSEWORKS_API_KEY = os.environ.get("GOOSEWORKS_API_KEY")

    plugins/neuRysiek-skills/skills/ads/capabilities/google-ad-scraper/scripts/search_google_ads.py, line 38

    token = cli_token or GOOSEWORKS_API_KEY or os.environ.get("APIFY_API_TOKEN")

    plugins/neuRysiek-skills/skills/ads/capabilities/meta-ad-scraper/scripts/search_meta_ads.py, line 24

    GOOSEWORKS_API_KEY = os.environ.get("GOOSEWORKS_API_KEY")

    plugins/neuRysiek-skills/skills/ads/capabilities/meta-ad-scraper/scripts/search_meta_ads.py, line 34

    token = cli_token or GOOSEWORKS_API_KEY or os.environ.get("APIFY_API_TOKEN")

    plugins/neuRysiek-skills/skills/ads/capabilities/render-hypermotion/scripts/PIPELINE.md, line 55

    os.environ["FAL_KEY"] = os.environ.get("FAL_API_KEY", "")

    plugins/neuRysiek-skills/skills/ads/packs/ugc-video-formats/review-ugc-render/scripts/review_render.py, line 147

    api_key = os.environ.get("OPENAI_API_KEY")

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Concern

    contains an encoded blob in a file that should be readable.

    OBFUSCATION_ENCODED_BLOB

    plugins/neuRysiek-skills/skills-index.json, line 1

    {

    plugins/neuRysiek-skills/skills/ads/packs/video-ad-formats/create-chatgpt-mockup/references/1.png, line 1

    version https://git-lfs.github.com/spec/v1

    plugins/neurise-seo/assets/cover.svg, line 109

    <image id="earthTex" xlink:href="data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAAAAAAAAD/2wBDACYaHSEdGCYhHyErKCYtOV8+OTQ0OXVTWEVfinmRj4h5hYOYq9u6mKLPpIOFvv/Bz+Lp9fj1lLf////u/9vw9ez/2wBD

  • Licence

    Note

    no licence file found.

    LICENCE_MISSING

    No file path was stored.

    no licence file found.

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 65a04180ff37. requests shell access. No manifest field names shell or command execution. can delete files. install fetches a script from the network. accepts a host from input, with no fixed list in this file. reads a credential or environment file. contains an encoded blob in a file that should be readable. no licence file found.

Date and source

Date checked:

View source

github.com

Commit graded: 65a04180ff37ec86c2bd99b0af8499f6533e0dec

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen