Claude Code, Skill
Repo Structure In House
The folder layout that gives Claude Code your company's context before it writes anything.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 4016985f52ad, unchanged since the check below.
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
Why this grade
- NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
.claude/connections.md, line 23
### 1. Exa - web search + page fetch (wired by default) - SECRETS_PATH_DOTENV Low
Mentions a .env file.
.claude/connections.md, line 27
- **Install:** Already in `.mcp.json`. Add your free API key to `.env`:
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
.claude/connections.md, line 23
### 1. Exa - web search + page fetch (wired by default)
.claude/connections.md, line 25
- **What:** Indexed web search built for AI - better than generic search for research queries. Also handles page fetch (clean markdown extraction).
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
.claude/connections.md, line 27
- **Install:** Already in `.mcp.json`. Add your free API key to `.env`:
.claude/settings.local.json.example, line 12
"_note": "If you have machine-specific env vars not appropriate for .env (which is shared in team setups), put them here. Most users don't need this.",
.claude/skills/level/references/build-steps.md, line 25
Take their most-used skill; rewrite it with phases + approval gates + a subagent call. Reference their memory/patterns for consistency. Then add one quality-gate hook (e.g. a PreTo
Show more
.claude/skills/level/references/roadmaps.md, line 66
4. **Set up hooks as quality gates** (10 min). PreToolUse (block writes to `.env`), PostToolUse (auto-lint). Add **output styles** to shape voice. Hooks are guardrails, not infra.
.gitignore, line 1
# Secrets - never commit
.gitignore, line 2
.env
.gitignore, line 4
!.env.example
README.md, line 27
Web research works best with an [Exa](https://exa.ai) key in `.env` (copy `env` to `.env`). Without one, the skills fall back to plain web search.
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 4016985f52ad. can reach a host that is not written as a fixed address. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 4016985f52ad80873aaae96e87a7f2fc6a09836b
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.