Claude Code, Skill
Nuclear Grade Context Engineering
Risk-graded context engineering for AI-assisted software work — a catalog of agent skills, paste-ready command prompts, and change-record templates that keep agent work questioned, controlled, and reviewable.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 79f8bac5f973, unchanged since the check below.
SECRETS_PATH_UNCONFIRMED PERMISSION_SHELL_DECLARED OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED
Why this grade
- SECRETS_PATH_UNCONFIRMED Low
The Secrets check reports a credential or environment file, but no quoted line shows a recognisable path.
.gitignore, line 21
env/ - PERMISSION_SHELL_DECLARED Note
Runs shell commands, and the manifest or description says so.
challenge/score.py, line 224
result = subprocess.run(["git", *args], cwd=target, capture_output=True, text=True, timeout=30) - OBFUSCATION_FILE_OVER_READ_CAP Note
A file was over the read cap and was not fully read.
docs/06-publications/research/data/arxiv-self-evaluation-results.json, line 1
[ - OBFUSCATION_FILE_CAP_REACHED Note
The 400 file cap was reached before every file was read.
docs/06-publications/research/data/arxiv-self-evaluation-results.json, line 1
[
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Note
requests shell access. The manifest names this permission.
PERMISSION_SHELL_DECLARED
challenge/score.py, line 224
result = subprocess.run(["git", *args], cwd=target, capture_output=True, text=True, timeout=30)
challenge/score.py, line 614
run = subprocess.run(
challenge/score.py, line 683
run = subprocess.run(command, cwd=target, capture_output=True, text=True, timeout=PROBE_TIMEOUT, env=_env(tmp))
Show more
docs/assets/demo/simulate_tool_call.py, line 24
result = subprocess.run(
.nuclear/changes/skill-benchmark-and-amendments/verification.md, line 78
| The fifth fix's grader-failure handling was itself incomplete on the RCQ pilot's own path, on both sides (catching the failure and consuming its result) | Codex reviewed a sixth
.nuclear/changes/skill-benchmark-and-amendments/verification.md, line 79
| The RCQ error-handling chain still had two more gaps: the producer side (subject-run timeout) didn't tag its own metadata, and a second consumer (the round-1 report generator, no
.nuclear/changes/skill-benchmark-and-amendments/verification.md, line 80
| The exact bug class Codex had been finding one script at a time (uncaught `subprocess.run` crashing a rerun instead of producing a gracefully-handled error record) was still pres
.nuclear/changes/skill-benchmark-and-amendments/verification.md, line 82
| The gap named openly in `ship.md` after round eight -- `grade_validation.py`/`ccr_amend_grade_validation.py` not excluding subject-run errors before grading -- turned out to be r
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Pass
No network call found.
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_UNCONFIRMED
.gitignore, line 21
env/
evals/skill-benchmark-pilot/data/all-skills-pilot/runs/briefing-an-agent__without_skill__trial1.json, line 15
"result": "Running unattended schema changes + backfills directly against production overnight is risky \u2014 if the migration locks the table, the heuristic mislabels users, or s
evals/skill-benchmark-pilot/data/briefing-an-agent-amendment-validation/runs/briefing-an-agent-true-niche__with_skill__trial4.json, line 15
"result": "Before I draft this, one thing needs pushback: the table includes customer emails, shipping addresses, and order totals \u2014 that's PII, and you're asking for full aut
Show more
evals/skill-benchmark-pilot/data/multi-model-check/runs/learning-from-experience__without_skill__trial1.json, line 15
"result": "Let me create a comprehensive post-incident review document for you.\n\n## Post-Incident Review: Hardcoded API Key Exposure\n\n### Executive Summary\nA hardcoded API key
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read. the file cap was reached before every file was read.
OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED
docs/06-publications/research/data/arxiv-self-evaluation-results.json, line 1
[
docs/06-publications/research/data/arxiv-targeted-results.json, line 1
[
docs/06-publications/research/data/novelty-search-candidates.json, line 1
[
Show more
evals/skill-benchmark-pilot/data/all-skills-pilot/runs/using-nuclear-grade__with_skill__trial2.json, line 1
{
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 79f8bac5f973. requests shell access. The manifest names this permission. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.
Date and source
Date checked:
github.com
Commit graded: 79f8bac5f9735e2d72bc40d495a98d1fdb566d0c
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.