Claude Code, Skill
qstack
Agent skills for planning work, executing it against the plan, and proving the result.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
OBFUSCATION_MINIFIED_PAYLOAD
Why this grade
- OBFUSCATION_MINIFIED_PAYLOAD Medium
Contains a very long line with almost no spaces in a script or style file.
qstack/compound_engineering/plans/qstack-review/board-events.js, line 114
qstackBoardEvent({"ts":"2026-08-30T14:34:48Z","event":"created","actor":"dallas","card":"T-24","epic":"review","title":"R4 P2 sweep: resume path, loop drift, cross-skill false posi
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Note
requests shell access. The manifest names this permission.
PERMISSION_SHELL_DECLARED
scripts/qstack-version, line 71
return subprocess.run(
scripts/test-board-deeplink, line 196
done = subprocess.run(
scripts/test-card-ref, line 61
return subprocess.run(
Show more
scripts/test-card-ref, line 143
dead = subprocess.Popen(["true"])
scripts/test-plan-asset-update, line 44
return subprocess.run(
scripts/test-plan-asset-update, line 121
subprocess.run(
scripts/test-plan-asset-update, line 128
result = subprocess.run(
scripts/test-plan-asset-update, line 139
missing_repo = subprocess.run(
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach github.com. The description does not name that host. can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
skills/qstack-plan-to-html/template/v1/fonts/README.md, line 25
curl -s "https://fonts.googleapis.com/css2?family=Archivo:[email protected]&display=swap" \
CHANGELOG.md, line 583
* verify the human-review tag instead of pinning a commit npx cannot fetch ([#15](https://github.com/hani-q/qstack/issues/15)) ([a6b872d](https://github.com/hani-q/qstack/commit/a6
qstack/scripts/card-ref, line 121
with socket.create_connection((target, int(port)), PROBE_TIMEOUT_SECONDS):
Show more
skills/qstack-choose-model/scripts/qstack-models, line 66
with urllib.request.urlopen(req, timeout=timeout) as r:
skills/qstack-choose-model/scripts/qstack-models, line 75
data = fetch()
skills/qstack-choose-model/scripts/qstack-models, line 250
def fetch():
skills/qstack-plan-to-html/template/card-ref, line 121
with socket.create_connection((target, int(port)), PROBE_TIMEOUT_SECONDS):
skills/qstack-ui-prototype/scripts/check-upstream, line 59
def fetch(repo: str, ref: str, path: str) -> bytes:
skills/qstack-ui-prototype/scripts/check-upstream, line 61
with urllib.request.urlopen(url, timeout=30) as response:
Secrets
Pass
No read of a credential file or secret environment variable found.
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains a minified payload.
OBFUSCATION_MINIFIED_PAYLOAD
qstack/compound_engineering/plans/qstack-review/board-events.js, line 114
qstackBoardEvent({"ts":"2026-08-30T14:34:48Z","event":"created","actor":"dallas","card":"T-24","epic":"review","title":"R4 P2 sweep: resume path, loop drift, cross-skill false posi
skills/qstack-plan-to-html/template/v1/pretext.js, line 14
var x0=["BN","BN","BN","BN","BN","BN","BN","BN","BN","S","B","S","WS","B","BN","BN","BN","BN","BN","BN","BN","BN","BN","BN","BN","BN","BN","BN","B","B","B","S","WS","ON","ON","ET",
skills/qstack-plan-to-html/template/v1/pretext.js, line 18
`)return"hard-break"}if(O===" ")return"space";if(O===" "||O===" "||O===""||O==="\uFEFF")return"glue";if(O==="")return"zero-width-break";if(O==="")return"soft-hyphen";return"text
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit afd6234badab. requests shell access. The manifest names this permission. can reach github.com. The description does not name that host. can reach a host that is not written as a fixed address. contains a minified payload.
Date and source
Date checked:
github.com
Commit graded: afd6234badab587028cce85444fb92ed99831471
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.