Grades are a hygiene check, not a security guarantee.

Claude Code, Skill

Oil Ui

设计、改进和评审网站、App、后台与组件的界面：探索设计方向、生成多风格同屏对比页，并基于真实截图打磨视觉层级；按请求交付对比页、设计说明、设计稿或可运行界面。只负责设计判断，不用于纯业务逻辑、接口构建、无界面变化的代码整理，或改法已完全明确的日常修改（如改文案、调数量、删指定元素、复用现有样式，哪怕带有“优化”字样）。已安装 oil-ui-pro 时交给 oil-ui-pro。

Compatibility: Not stated.

Grade B

Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED SECRETS_ENV_READ

Why this grade

  • PERMISSION_DELETE_FILES Low

    Contains a call that can delete files.

    scripts/check_update.py, line 141 result = subprocess.run([node, "--version"], env=update_environment(), capture_output=True, text=True, timeout=3, encoding="utf-8")

  • NETWORK_NO_FIXED_HOST Low

    Makes a network call whose host is not written as a fixed address.

    scripts/build_explorer.py, line 212 command = f"curl -L --fail --output {shlex.quote(str(destination))} -- {shlex.quote(ref)}"

  • SECRETS_PATH_UNCONFIRMED Low

    The Secrets check reports a credential or environment file, but no quoted line shows a recognisable path.

    scripts/check_update.py, line 81 if os.environ.get("OIL_TOKEN"):

  • SECRETS_ENV_READ Note

    Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.

    scripts/check_update.py, line 81 if os.environ.get("OIL_TOKEN"):

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Concern

    can delete files.

    PERMISSION_DELETE_FILES

    scripts/check_update.py, line 141

    result = subprocess.run([node, "--version"], env=update_environment(), capture_output=True, text=True, timeout=3, encoding="utf-8")

    scripts/check_update.py, line 182

    result = subprocess.run([npx, "-y", CLI, "update", name, "--path", str(ROOT), "--json"], env=env,

    scripts/curate-media.mjs, line 207

    } finally { await fs.rm(temp, { force: true }); await fs.rmdir(lock); }

    Show more

    scripts/curate-media.mjs, line 574

    } finally { await fs.rm(temp, { recursive: true, force: true }); }

    scripts/curate-media.mjs, line 675

    catch (e) { recovery.push(`${candidate}: ${e.message}`); await fs.rm(temp, { force: true }); }

    scripts/curate-media.mjs, line 695

    finally { await fs.rm(posterTemp, { force: true }); }

    scripts/curate-media.mjs, line 700

    } finally { await fs.rm(temp, { force: true }); }

    scripts/oiloil-image.mjs, line 196

    if (dir) await fs.rm(dir, { recursive: true, force: true }).catch(() => {});

    scripts/oiloil-image.mjs, line 279

    await fs.rm(file, { force: true }).catch(() => {});

    scripts/oiloil-image.mjs, line 377

    if (recovery && !recovery.received) await fs.rm(recovery.file, { force: true }).catch(() => {});

  • Install and update

    Pass

    No install-time script found, and dependencies are pinned or absent.

  • Network

    Concern

    can reach a host that is not written as a fixed address.

    NETWORK_NO_FIXED_HOST

    scripts/build_explorer.py, line 212

    command = f"curl -L --fail --output {shlex.quote(str(destination))} -- {shlex.quote(ref)}"

    scripts/check_update.py, line 109

    def fetch(name: str) -> dict | None:

    scripts/check_update.py, line 111

    with urllib.request.urlopen(request, timeout=FETCH_TIMEOUT) as response:

    Show more

    scripts/check_update.py, line 284

    found = fetch(name)

    scripts/curate-media.mjs, line 138

    const res = await fetch(httpUrl(url), { headers: { ...headersFor(url), Accept: 'application/json' }, signal: AbortSignal.timeout(opts.timeout) });

    scripts/curate-media.mjs, line 586

    const res = await fetch(httpUrl(url), { headers: headersFor(url), signal: AbortSignal.timeout(opts['download-timeout']) });

    scripts/oiloil-image.mjs, line 206

    response = await fetch(`${root}/v1/${endpoint}`, {

    scripts/prep-image.mjs, line 125

    ws = new WebSocket(url);

  • Secrets

    Concern

    reads a credential or environment file.

    SECRETS_ENV_READ SECRETS_PATH_UNCONFIRMED

    scripts/check_update.py, line 81

    if os.environ.get("OIL_TOKEN"):

    scripts/check_update.py, line 148

    context = [API, file_signature(config_path()), os.environ.get("OIL_TOKEN", ""),

    .gitignore, line 2

    __pycache__/

    Show more

    .gitignore, line 4

    !.env.example

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Pass

    No encoded or minified payload found.

  • Licence

    Pass

    A licence file is present (LICENSE).

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit c60d91d0ebdc. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file.

Date and source

Date checked:

View source

github.com

Commit graded: c60d91d0ebdcfb96cac6f3988823291549ea6190

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen