Claude Code, Skill
Rea Reconstruction Companion
Understand existing software.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB OBFUSCATION_MINIFIED_PAYLOAD
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
evals/import-export/candidate.mjs, line 78
try { fs.unlinkSync(sibling); } catch { /* best-effort temporary cleanup */ } - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
evals/asynchronous-results/controlled.mjs, line 16
const item = requests.get(id); - OBFUSCATION_ENCODED_BLOB Low
Contains a long base64 shaped string in a file that should be readable.
evals/browser-improvement/browser-check.mjs, line 15
return {rows:[...el('rows').querySelectorAll('button')].map(n=>n.textContent),selected:[...el('rows').querySelectorAll('button')].map(n=>n.getAttribute('aria-pressed')),title:el('t - OBFUSCATION_MINIFIED_PAYLOAD Low
Contains a very long line with almost no spaces in a script or style file.
evals/browser-improvement/browser-check.mjs, line 15
return {rows:[...el('rows').querySelectorAll('button')].map(n=>n.textContent),selected:[...el('rows').querySelectorAll('button')].map(n=>n.getAttribute('aria-pressed')),title:el('t
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
evals/import-export/candidate.mjs, line 78
try { fs.unlinkSync(sibling); } catch { /* best-effort temporary cleanup */ }
evals/import-export/reference.mjs, line 57
try { fs.unlinkSync(temp); } catch { /* orphan cleanup is best effort */ }
evals/measured-optimization/candidate.mjs, line 81
try { fs.unlinkSync(sibling); } catch { /* best-effort temporary cleanup */ }
Show more
evals/reference/check.mjs, line 76
if (rel.startsWith('rea-reference-') && !rel.includes(path.sep) && !fs.lstatSync(root).isSymbolicLink()) fs.rmSync(root, { recursive: true, force: true });
evals/reference/reconstruction/candidate.mjs, line 74
if (owned) fs.unlinkSync(pending);
evals/reference/reconstruction/validate.mjs, line 74
fs.rmSync(root, { recursive: true, force: true });
evals/reference/target/pocket-tasks.mjs, line 103
finally { if (owned) fs.unlinkSync(temporary); }
evals/unavailable-backend/candidate.mjs, line 96
fs.rmSync(directory, { recursive: true, force: true });
scripts/verify_release.py, line 56
subprocess.run(['node', 'scripts/run-checks.mjs'], cwd=package, check=True)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
evals/asynchronous-results/controlled.mjs, line 16
const item = requests.get(id);
Secrets
Pass
No read of a credential file or secret environment variable found.
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains a minified payload. contains an encoded blob in a file that should be readable.
OBFUSCATION_ENCODED_BLOB OBFUSCATION_MINIFIED_PAYLOAD
evals/browser-improvement/browser-check.mjs, line 15
return {rows:[...el('rows').querySelectorAll('button')].map(n=>n.textContent),selected:[...el('rows').querySelectorAll('button')].map(n=>n.getAttribute('aria-pressed')),title:el('t
evals/combined-navigation/expectations.json, line 1
{
tests/resume-environment.test.mjs, line 1
import { fixtureLink } from '../scripts/fixture-environment.mjs';
Show more
evals/fixtures/rfc8439.json, line 7
"plaintext": "4c616469657320616e642047656e746c656d656e206f662074686520636c617373206f66202739393a204966204920636f756c64206f6666657220796f75206f6e6c79206f6e652074697020666f7220746865
evals/fixtures/rfc8439.json, line 8
"ciphertext": "d31a8d34648e60db7b86afbc53ef7ec2a4aded51296e08fea9e2b5a736ee62d63dbea45e8ca9671282fafb69da92728b1a71de0a9e060b2905d6a5b67ecd3b3692ddbd7f2d778b8c9803aee328091b58fab32
evals/import-export/observed.json, line 16
"exportHex": "7b22666f726d6174223a22706f636b65742d6c6564676572222c2276657273696f6e223a322c22656e7472696573223a5b7b226964223a22746561222c227469746c65223a2220205468c3a920e298955c6ee9
evals/import-export/observed.json, line 32
"exportHex": "7b22666f726d6174223a22706f636b65742d6c6564676572222c2276657273696f6e223a322c22656e7472696573223a5b7b226964223a2262222c227469746c65223a225365636f6e64222c22646f6e65223a
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit bfc1067085bd. can delete files. can reach a host that is not written as a fixed address. contains a minified payload. contains an encoded blob in a file that should be readable.
Date and source
Date checked:
github.com
Commit graded: bfc1067085bd32e5c6b15b3d5305142c2c080647
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.