Claude Code, Skill
Rseng Agent Skills
Research software engineering skills for coding agents: testing, CI/CD, documentation, licensing, citation, FAIR, publishing, reproducibility, code review, maintenance, planning and workflows, plus repo-audit commands and practice enforcement.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
NETWORK_HOST_FROM_INPUT
Why this grade
- NETWORK_HOST_FROM_INPUT Medium
A file takes a URL or endpoint as input and has no fixed host list.
pipeline/src/rseng_pipeline/net.py, line 19
with urllib.request.urlopen(url, timeout=30) as response:
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
installer/scripts/postpack.mjs, line 20
fs.rmSync(contentDir, { recursive: true, force: true });
installer/scripts/prepack.mjs, line 84
fs.rmSync(contentDir, { recursive: true, force: true });
installer/src/install.ts, line 210
fs.rmSync(old.abs, { recursive: true, force: true });
Show more
installer/src/uninstall.ts, line 100
fs.rmSync(abs, { force: true });
installer/src/uninstall.ts, line 112
fs.rmSync(path.join(target.installDir, manifestName(target.agent)), {
installer/src/update.ts, line 145
fs.rmSync(path.join(installDir, rel), { force: true });
pipeline/src/rseng_pipeline/build_adapters.py, line 143
shutil.rmtree(target_dir)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Serious
accepts a host from input, with no fixed list in this file.
NETWORK_HOST_FROM_INPUT
pipeline/src/rseng_pipeline/net.py, line 19
with urllib.request.urlopen(url, timeout=30) as response:
pipeline/src/rseng_pipeline/url_verify.py, line 57
with urllib.request.urlopen(request, timeout=timeout) as response:
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
adapters/rseng_check.py, line 129
f"here ({', '.join(uncovered)}) - add them plus .env and "
hooks/phase_lib.py, line 453
f"present here ({', '.join(missing)}) - add them (plus .env "
hooks/session-context.md, line 11
.agents/, .cursor/, .env, session records).
Show more
hooks/signals.json, line 198
".env",
hooks/signals.json, line 199
".env.*",
pipeline/src/rseng_pipeline/data/signals.json, line 198
".env",
pipeline/src/rseng_pipeline/data/signals.json, line 199
".env.*",
skills/rseng-reproducible-environments/SKILL.md, line 205
configuration ONCE (.env.example consumed by both), derive the
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read.
OBFUSCATION_FILE_OVER_READ_CAP
skills/rseng-software-reuse/data/rsd-escience.json, line 1
{
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 7bb48e306911. can delete files. accepts a host from input, with no fixed list in this file. reads a credential or environment file. a file was over the read cap and was not fully read.
Date and source
Date checked:
github.com
Commit graded: 7bb48e306911d8ff3daf19802e4d0d7dd30eba98
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.