Claude Code, Skill
Opencode Artes
Opencode Artes, a skill listed in the PlugVet directory.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
NETWORK_HOST_FROM_INPUT
Why this grade
- NETWORK_HOST_FROM_INPUT Medium
A file takes a URL or endpoint as input and has no fixed host list.
docs/skills/backend-suite-orchestrator/SKILL.md, line 229
with urllib.request.urlopen(url, timeout=10) as resp:
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
docs/skills/agent-self-debugger-loop/SKILL.md, line 357
return subprocess.run(
docs/skills/agent-self-debugger-loop/SKILL.md, line 364
subprocess.run(["git", "add", "-A"], cwd=str(root), capture_output=True, text=True)
docs/skills/agent-self-debugger-loop/SKILL.md, line 365
return subprocess.run(
Show more
docs/skills/backend-suite-orchestrator/SKILL.md, line 218
proc = subprocess.run(cmd, capture_output=True, text=True, timeout=180)
docs/skills/dependency-cve-audit-patcher/SKILL.md, line 120
proc = subprocess.run(cmd, cwd=str(manifest_dir), capture_output=True, text=True, timeout=180)
docs/skills/frontend-suite-orchestrator/SKILL.md, line 278
proc = subprocess.run(
docs/skills/git-bisect-time-traveler/SKILL.md, line 130
check = subprocess.run(
docs/skills/git-bisect-time-traveler/SKILL.md, line 149
proc = subprocess.run([self.git, *args],
docs/skills/git-bisect-time-traveler/SKILL.md, line 293
shutil.rmtree(tmp_dir, ignore_errors=True)
docs/skills/refactor-safety-harness/SKILL.md, line 70
fs.rmSync(beforeDir, { recursive: true, force: true });
scripts/sync-pages.js, line 15
fs.rmSync(to, { recursive: true, force: true });
skills/git-bisect-time-traveler/git-bisect-time-traveler.md, line 297
shutil.rmtree(tmp_dir, ignore_errors=True)
skills/refactor-safety-harness/refactor-safety-harness.md, line 74
fs.rmSync(beforeDir, { recursive: true, force: true });
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Serious
accepts a host from input, with no fixed list in this file.
NETWORK_HOST_FROM_INPUT
docs/skills/backend-suite-orchestrator/SKILL.md, line 229
with urllib.request.urlopen(url, timeout=10) as resp:
docs/skills/bola-idor-vulnerability-scanner/SKILL.md, line 145
with urllib.request.urlopen(req, timeout=10) as resp:
docs/skills/cors-csp-headers-hardener/SKILL.md, line 83
with urllib.request.urlopen(req, timeout=10) as resp:
Show more
docs/skills/dependency-fitness-scorecard/SKILL.md, line 55
const req = https.get(url, (res) => {
docs/skills/docker-multi-stage-stack-builder/SKILL.md, line 108
CMD wget -qO- http://localhost:3000/api/health || exit 1
docs/skills/docker-multi-stage-stack-builder/SKILL.md, line 463
curl -i http://localhost/api/health
docs/skills/dockerfile-builder/SKILL.md, line 39
HEALTHCHECK CMD ["node", "-e", "fetch('http://localhost:3000/health')"]
docs/skills/iot-hub-dashboard-builder/SKILL.md, line 232
conn = socket.create_connection(("127.0.0.1", port), timeout=2)
docs/skills/iot-hub-dashboard-builder/SKILL.md, line 248
c = socket.create_connection(("127.0.0.1", port), timeout=2)
docs/skills/lighthouse-web-vitals-optimizer/SKILL.md, line 485
// e.g. fetch("/api/analytics/web-vitals", { method: "POST", body: JSON.stringify(batch) })
docs/skills/lighthouse-web-vitals-optimizer/SKILL.md, line 491
fetch(beacon.href, {
docs/skills/llm-gateway-model-router/SKILL.md, line 262
curl -X POST http://127.0.0.1:8089/v1/chat/completions \
docs/skills/state-management-query-architect/SKILL.md, line 532
curl -s -X POST http://localhost:3000/api/todos \
docs/skills/websocket-realtime-sync-engine/SKILL.md, line 88
// Node 18+ ESM. Prefers the global WebSocket (Node 22+); falls back to 'ws'.
docs/skills/websocket-realtime-sync-engine/SKILL.md, line 277
socket = new this.WebSocket(this.url);
skills/docker-multi-stage-stack-builder/docker-multi-stage-stack-builder.md, line 112
CMD wget -qO- http://localhost:3000/api/health || exit 1
skills/docker-multi-stage-stack-builder/docker-multi-stage-stack-builder.md, line 467
curl -i http://localhost/api/health
skills/dockerfile-builder/dockerfile-builder.md, line 43
HEALTHCHECK CMD ["node", "-e", "fetch('http://localhost:3000/health')"]
skills/websocket-realtime-sync-engine/websocket-realtime-sync-engine.md, line 92
// Node 18+ ESM. Prefers the global WebSocket (Node 22+); falls back to 'ws'.
skills/websocket-realtime-sync-engine/websocket-realtime-sync-engine.md, line 281
socket = new this.WebSocket(this.url);
docs/skills/websocket-realtime-sync-engine/SKILL.md, line 658
1. **Provision the transport.** Confirm the server exposes a WebSocket (or
skills/websocket-realtime-sync-engine/websocket-realtime-sync-engine.md, line 662
1. **Provision the transport.** Confirm the server exposes a WebSocket (or
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
docs/skills/auth-session-oauth2-scaffolder/SKILL.md, line 46
# .env.example
docs/skills/docker-multi-stage-stack-builder/SKILL.md, line 128
.env
docs/skills/docker-multi-stage-stack-builder/SKILL.md, line 129
.env.*
Show more
docs/skills/docker-multi-stage-stack-builder/SKILL.md, line 130
!.env.example
docs/skills/docker-multi-stage-stack-builder/SKILL.md, line 417
# .env.example
docs/skills/docker-multi-stage-stack-builder/SKILL.md, line 437
# scripts/entrypoint.sh, .env.example
docs/skills/docker-multi-stage-stack-builder/SKILL.md, line 439
# 3. Create .env from template (fill in real values)
docs/skills/docker-multi-stage-stack-builder/SKILL.md, line 440
cp .env.example .env
docs/skills/jwt-security-cracker-tester/SKILL.md, line 259
const JWT_SECRET = process.env.JWT_SECRET; // use a strong random secret: crypto.randomBytes(64).toString('hex')
docs/skills/jwt-token-rotator/SKILL.md, line 34
const access = jwt.sign({ sub: userId, type: 'access' }, process.env.ACCESS_SECRET, { expiresIn: ACCESS_TOKEN_TTL });
docs/skills/jwt-token-rotator/SKILL.md, line 35
const refresh = jwt.sign({ sub: userId, type: 'refresh', jti: crypto.randomUUID() }, process.env.REFRESH_SECRET, { expiresIn: REFRESH_TOKEN_TTL });
docs/skills/jwt-token-rotator/SKILL.md, line 45
const payload = jwt.verify(refreshToken, process.env.REFRESH_SECRET) as any;
docs/skills/playwright-e2e-security-flow-tester/SKILL.md, line 240
const TEST_USER_PASSWORD = process.env.TEST_USER_PASSWORD ?? "TestPassword123!";
docs/skills/playwright-e2e-security-flow-tester/SKILL.md, line 440
process.env.TEST_USER_PASSWORD ?? "TestPassword123!"
docs/skills/playwright-e2e-security-flow-tester/SKILL.md, line 466
process.env.VENDOR_PASSWORD ?? "VendorPass123!"
docs/skills/playwright-e2e-security-flow-tester/SKILL.md, line 600
process.env.TEST_USER_PASSWORD ?? "TestPassword123!"
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 086cb4b328cd. can delete files. accepts a host from input, with no fixed list in this file. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 086cb4b328cde3206a3b1fce8b18af3607810fa8
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.