Claude Code, Skill
SecondBrain
SecondBrain, a skill listed in the PlugVet directory.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
INSTALL_REMOTE_SCRIPT
Why this grade
- INSTALL_REMOTE_SCRIPT Medium
Fetches a script from the network and runs it (a pipe to a shell, or an install hook with a URL).
sessions/inbox/pyros-2026-08-10-185a41c4.md, line 41
curl -fsSL https://getpyros.com/install.sh | bash
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Serious
install fetches a script from the network.
INSTALL_REMOTE_SCRIPT
sessions/inbox/pyros-2026-08-10-185a41c4.md, line 41
curl -fsSL https://getpyros.com/install.sh | bash
sessions/inbox/pyros-2026-08-10-185a41c4.md, line 92
curl -fsSL https://getpyros.com/install.sh | bash
sessions/inbox/pyros-2026-08-10-185a41c4.md, line 135
`INSTALLER_ROOT`), reload Caddy. Then `curl -fsSL https://getpyros.com/install.sh | bash` is live.
Show more
sessions/inbox/pyros-2026-08-10-185a41c4.md, line 140
set INSTALLER_ROOT), reload Caddy. Then curl -fsSL https://getpyros.com/install.sh | bash is live. what exactly need to do and wh
sessions/inbox/pyros-2026-08-10-185a41c4.md, line 219
curl -fsSL https://getpyros.com/install.sh | bash
sessions/inbox/pyros-2026-08-10-185a41c4.md, line 359
5. Test: `curl -fsSL https://getpyros.com/install.sh | bash`
sessions/inbox/pyros-2026-08-10-185a41c4.md, line 392
curl -fsSL https://pyros-wl.vercel.app/install.sh | bash
sessions/inbox/pyros-2026-08-10-185a41c4.md, line 405
curl -fsSL https://getpyros.com/install.sh | bash
sessions/inbox/pyros-2026-08-10-185a41c4.md, line 455
curl -fsSL https://pyros-wl.vercel.app/install.sh | bash
sessions/inbox/pyros-2026-08-10-185a41c4.md, line 464
curl -fsSL https://getpyros.com/install.sh | bash
sessions/inbox/pyros-2026-08-10-185a41c4.md, line 508
curl -fsSL https://getpyros.com/install.sh | bash # installs pyros (no npm/Node)
requirements.txt, line 3
fastembed>=0.3.6 # ONNX CPU embeddings, no torch, no keys
Network
Pass
No network call found.
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
sessions/inbox/aethera_staking-2026-08-16-0cb47dca.md, line 245
**claude:** Everything's in place: aptos CLI 9.5.0, package deployed at `0x863020…771e1`, profile `testnet_v2` = that same admin account, and `MARKETPLACE_FEE_BPS`/`FEE_COLLECTOR`/
sessions/inbox/aethera_staking-2026-08-16-0cb47dca.md, line 249
- **`.env` `CONTRACT_ADDRESS`** = `0x3894…8747` (the `default` aptos profile)
sessions/inbox/aethera_staking-2026-08-16-0cb47dca.md, line 256
- **`0x3894…8747`** (what `.env` currently points at) → only `state` deployed. **No `marketplace`, no `project_token`.**
Show more
sessions/inbox/aethera_staking-2026-08-16-0cb47dca.md, line 259
So with the current `.env`, every new endpoint will fail. Let me check whether the hubs are already initialized on-chain at `0x863…` (tells us what server boot will do):
sessions/inbox/aethera_staking-2026-08-16-0cb47dca.md, line 265
## ⚠️ First: fix `.env` (required - this is currently broken)
sessions/inbox/aethera_staking-2026-08-16-0cb47dca.md, line 267
Your `.env` points `CONTRACT_ADDRESS` at `0x3894…8747`, which only has the **old** `state` module. The redeployed contract with `project_token` + `marketplace` lives at **`0x863020
sessions/inbox/aethera_staking-2026-08-16-0cb47dca.md, line 271
| `0x3894…` (current `.env`) | ✅ | ❌ | ❌ |
sessions/inbox/aethera_staking-2026-08-16-0cb47dca.md, line 276
Edit `server/.env` - set the contract to the real deployment and the admin key to the `testnet_v2` account (which *is* `0x863…`, the hub admin):
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Note
no licence file found.
LICENCE_MISSING
No file path was stored.
no licence file found.
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 53503c9b28b5. install fetches a script from the network. reads a credential or environment file. no licence file found.
Date and source
Date checked:
github.com
Commit graded: 53503c9b28b558956695e582184207020f406e97
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.