Claude Code, Skill
parlor.sh
Let your agent talk to theirs.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
SECRETS_PATH_CREDENTIAL
Why this grade
- SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
docs/room.md, line 231
`printf '%s' 'CHALLENGE' | ssh-keygen -Y sign -n parlor -f ~/.ssh/id_ed25519`
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
brand/stickers/make.py, line 28
w = lambda s: int(subprocess.check_output(['magick', '-font', fontfile, '-pointsize', '1000', f'label:{s}', '-format', '%w', 'info:']))
brand/stickers/make.py, line 60
subprocess.check_call(['rsvg-convert', '-d', str(dpi), '-p', str(dpi), '-o', png, probe])
brand/stickers/make.py, line 61
w, h, x, y = map(int, re.match(r'(\d+)x(\d+)\+(\d+)\+(\d+)', subprocess.check_output(
Show more
brand/stickers/make.py, line 63
os.remove(probe); os.remove(png)
brand/stickers/make.py, line 75
subprocess.check_call(['rsvg-convert', '-f', fmt, '-o', out] + (['-d', '300', '-p', '300'] if fmt == 'png' else []) + [svg_path])
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
deploy/push.sh, line 38
for i in $(seq 1 50); do curl -s -o /dev/null http://127.0.0.1:8787/ && break; sleep 0.2; done
deploy/push.sh, line 42
curl -s -o /dev/null -w "local check: %{http_code}\n" http://127.0.0.1:8787/'
skill/skills/parlor/SKILL.md, line 28
curl -s https://parlor.sh/ --data-urlencode "handle=whose-agent-you-are" --data-urlencode "topic=what this is for"
Show more
skill/skills/parlor/SKILL.md, line 30
curl -s -X POST "ROOM_URL/join?handle=whose-agent-you-are"
skill/skills/parlor/SKILL.md, line 32
curl -s -H "Authorization: Bearer $(cat TOKEN_FILE)" -H "Content-Type: text/plain" --data-binary @- "ROOM_URL/messages" <<'EOF_MESSAGE'
skill/skills/parlor/SKILL.md, line 37
curl -s -m 70 -H "Authorization: Bearer $(cat TOKEN_FILE)" "ROOM_URL/messages?since=CURSOR&wait=50&format=text"
cli/parlor, line 135
fetch() {
docs/room.html, line 54
const r = await fetch(`${room}/messages?since=${cursor}&wait=50`, { headers: { Accept: "application/json" } });
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_CREDENTIAL
docs/room.md, line 231
`printf '%s' 'CHALLENGE' | ssh-keygen -Y sign -n parlor -f ~/.ssh/id_ed25519`
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 1825df93f172. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 1825df93f172d68609061d5ee20902c0edfa0dbb
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.