Claude Code, Plugin
Ship Plugin
A gated idea-to-production pipeline for Claude Code: research -> spec -> build -> layered QA (functional + eval + a parallel expert-agent panel) -> prod-prep -> provision -> deploy -> monitor, with reusable doc templates (including a gitleaks pre-commit + CI secret scan).
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 08c4134116d3, unchanged since the check below.
PERMISSION_DELETE_FILES SECRETS_PATH_DOTENV
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
scripts/context_builder.py, line 158
return subprocess.run(["git", "-C", project, *args], - SECRETS_PATH_DOTENV Low
Mentions a .env file.
scripts/context_builder.py, line 243
if r.endswith((".json", ".yml", ".yaml", ".toml", ".ini", ".cfg", ".env.example")):
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
scripts/context_builder.py, line 158
return subprocess.run(["git", "-C", project, *args],
scripts/gate_check.py, line 59
return subprocess.run(["git", "-C", project, *args], capture_output=True,
scripts/scaffold_project.py, line 82
subprocess.run(["git", "init", "-q", "-b", "main", dest], check=False, capture_output=True)
Show more
scripts/test_context_builder.py, line 33
return subprocess.run(["git", "-C", project, *a], capture_output=True, text=True)
scripts/test_context_builder.py, line 127
shutil.rmtree(p, ignore_errors=True)
scripts/test_context_builder.py, line 159
shutil.rmtree(d, ignore_errors=True)
scripts/test_context_builder.py, line 169
shutil.rmtree(d, ignore_errors=True)
scripts/test_context_builder.py, line 179
shutil.rmtree(d, ignore_errors=True)
scripts/test_context_builder.py, line 195
shutil.rmtree(p, ignore_errors=True)
scripts/test_context_builder.py, line 208
shutil.rmtree(p, ignore_errors=True)
scripts/test_context_builder.py, line 218
shutil.rmtree(p, ignore_errors=True)
scripts/test_context_builder.py, line 229
shutil.rmtree(p, ignore_errors=True)
scripts/test_gate_check.py, line 27
subprocess.run(["git", "-C", d, *a], check=False, capture_output=True)
scripts/test_gate_check.py, line 29
subprocess.run(["git", "-C", d, "add", "-A"], check=False, capture_output=True)
scripts/test_gate_check.py, line 30
subprocess.run(["git", "-C", d, "-c", "commit.gpgsign=false", "commit", "-qm", "x"],
scripts/test_gate_check.py, line 289
subprocess.run(["git", "-C", d, *a], check=False, capture_output=True)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Pass
No network call found.
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
scripts/context_builder.py, line 243
if r.endswith((".json", ".yml", ".yaml", ".toml", ".ini", ".cfg", ".env.example")):
scripts/scaffold_project.py, line 26
"env.example": ".env.example",
scripts/test_gate_check.py, line 324
".env.example": "K=\n", ".gitignore": ".env\n", ".pre-commit-config.yaml": "repos: []\n",
Show more
README.md, line 195
- **Secrets** live in `.env` (git-ignored) with a committed `.env.example`; Ship never prints live secrets.
README.md, line 312
It also scaffolds `.env.example`, `.gitignore`, pre-commit secret scanning, and a CI workflow.
agents/ship-devops-reviewer.md, line 15
- **Environment hygiene**: envs (local→staging→prod) cleanly separated; `.env.example` complete;
agents/ship-devops-reviewer.md, line 29
- Read `production_runbook.md`, compose/systemd files, CI config, `.env.example`.
agents/ship-security-reviewer.md, line 20
- **Secrets**: nothing sensitive committed; `.env` gitignored; no secrets in logs, URLs,
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 08c4134116d3. can delete files. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 08c4134116d3f512285e17e64081cf66027f9113
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.