Claude Code, Skill
See Skill
See Skill, a skill listed in the PlugVet directory.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 2b7aee829b61, unchanged since the check below.
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV PERMISSION_SHELL_DECLARED
Why this grade
- NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
see/scripts/credential-ui/public/app.js, line 13
response = await fetch(url, { ...options, credentials: ' - SECRETS_PATH_DOTENV Low
Mentions a .env file.
see/scripts/parse_media.py, line 150
values.update(read_env_file(directory / ".env.local")) - PERMISSION_SHELL_DECLARED Note
Runs shell commands, and the manifest or description says so.
see/scripts/onboard.py, line 191
subprocess.run(
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Note
requests shell access. The manifest names this permission.
PERMISSION_SHELL_DECLARED
see/scripts/onboard.py, line 191
subprocess.run(
see/scripts/parse_media.py, line 482
subprocess.run(
see/scripts/parse_media.py, line 576
result = subprocess.run(command, check=True, capture_output=True, text=True, timeout=timeout)
Show more
see/scripts/parse_media.py, line 600
subprocess.run(
see/scripts/parse_media.py, line 656
result = subprocess.run(
see/scripts/parse_media.py, line 684
result = subprocess.run(
see/scripts/parse_media.py, line 718
subprocess.run(["magick", str(path), str(converted)], check=True, capture_output=True)
see/scripts/parse_media.py, line 721
subprocess.run(
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
see/scripts/credential-ui/public/app.js, line 13
response = await fetch(url, { ...options, credentials: '
see/scripts/credential-ui/web/app.ts, line 15
response = await fetch(url, { ...options, credentials: '
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
see/scripts/parse_media.py, line 150
values.update(read_env_file(directory / ".env.local"))
README.md, line 146
普通配置保存供应商、模型和系统凭据引用，并限制为仅当前用户可读写；新密钥不写入该文件。环境变量优先级最高，适合 CI 或不希望落盘的用户；项目 `.env.local` 其次，用户私有配置最后。
see/SKILL.md, line 49
也兼容厂商变量：`ZENMUX_API_KEY`、`DASHSCOPE_API_KEY`、`OPENROUTER_API_KEY`、`TOKENDANCE_API_KEY`。配置读取顺序为环境变量 → `.env.local` → 用户私有配置。
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 2b7aee829b61. requests shell access. The manifest names this permission. can reach a host that is not written as a fixed address. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 2b7aee829b613868b42bb57040474c984f07eeda
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.