Claude Code, Skill
Skill Entropy Rl
Skill Entropy Rl, a skill listed in the PlugVet directory.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV SECRETS_ENV_READ OBFUSCATION_FILE_OVER_READ_CAP
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
calculate_skill_entropy/calculate_entropy_w_outputs.py, line 381
res = subprocess.run( - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
skill_entropy_rl/agent_system/environments/env_manager.py, line 138
memory_ctx, _ = self.memory.fetch( - SECRETS_PATH_DOTENV Low
Mentions a .env file.
evaluation/math_evaluation/latex2sympy/scripts/setup.sh, line 10
if test -d .env - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
calculate_skill_entropy/calculate_accuracy_based_entropy.py, line 333
resolved_api_key = api_key or os.getenv("ANTHROPIC_API_KEY") - OBFUSCATION_FILE_OVER_READ_CAP Note
A file was over the read cap and was not fully read.
evaluation/math_evaluation/latex2sympy/antlr-4.11.1-complete.jar, line 1
PK
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
calculate_skill_entropy/calculate_entropy_w_outputs.py, line 381
res = subprocess.run(
calculate_skill_entropy/calculate_entropy_w_outputs.py, line 422
res = subprocess.run(
skill_entropy_rl/agent_system/environments/env_package/skill2_bench/env.py, line 120
res = subprocess.run([sys.executable, fname], input=inp,
Show more
skill_entropy_rl/verl/utils/fs.py, line 232
shutil.rmtree(local_path, ignore_errors=True)
skill_entropy_rl/verl/utils/fs.py, line 234
os.remove(local_path)
skill_entropy_rl/verl/utils/fs.py, line 247
shutil.rmtree(local_path, ignore_errors=True)
skill_entropy_rl/verl/utils/hdfs_io.py, line 141
return os.system(cmd)
skill_entropy_rl/verl/utils/checkpoint/checkpoint_manager.py, line 85
shutil.rmtree(abs_path, ignore_errors=True)
skill_entropy_rl/verl/utils/checkpoint/fsdp_checkpoint_manager.py, line 107
os.remove(local_model_path) if is_non_local(local_model_path) else None
skill_entropy_rl/verl/utils/checkpoint/fsdp_checkpoint_manager.py, line 108
os.remove(local_optim_path) if is_non_local(local_optim_path) else None
skill_entropy_rl/verl/utils/checkpoint/fsdp_checkpoint_manager.py, line 109
os.remove(local_extra_state_path) if is_non_local(local_extra_state_path) else None
skill_entropy_rl/verl/utils/checkpoint/megatron_checkpoint_manager.py, line 219
os.remove(local_path) if is_non_local(local_path) else None
skill_entropy_rl/verl/utils/reward_score/prime_code/testing_util.py, line 622
subprocess.Popen = None # type: ignore
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
skill_entropy_rl/agent_system/environments/env_manager.py, line 138
memory_ctx, _ = self.memory.fetch(
skill_entropy_rl/agent_system/environments/env_manager.py, line 289
memory_contexts, valid_lens = self.memory.fetch(
skill_entropy_rl/agent_system/environments/env_manager.py, line 464
memory_contexts, valid_lens = self.memory.fetch(
Show more
skill_entropy_rl/agent_system/environments/env_manager.py, line 647
memory_contexts, valid_lens = self.memory.fetch(
skill_entropy_rl/agent_system/environments/env_package/skill2_bench/reward_variants.py, line 130
with urllib.request.urlopen(req, timeout=120) as resp:
skill_entropy_rl/agent_system/memory/base.py, line 50
def fetch(self, step: int):
skill_entropy_rl/agent_system/memory/memory.py, line 58
def fetch(
skill_entropy_rl/agent_system/memory/memory.py, line 142
def fetch(
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
calculate_skill_entropy/calculate_accuracy_based_entropy.py, line 333
resolved_api_key = api_key or os.getenv("ANTHROPIC_API_KEY")
calculate_skill_entropy/calculate_accuracy_based_entropy.py, line 335
resolved_api_key = api_key or os.getenv("GEMINI_API_KEY") or os.getenv("GOOGLE_API_KEY")
evaluation/math_evaluation/latex2sympy/scripts/setup.sh, line 10
if test -d .env
Show more
calculate_skill_entropy/calculate_accuracy_based_entropy.py, line 337
resolved_api_key = api_key or os.getenv("OPENAI_API_KEY")
calculate_skill_entropy/calculate_accuracy_based_entropy.py, line 345
resolved_api_key = os.getenv("OPENAI_API_KEY")
evaluation/eval_checkpoint.py, line 185
return ("genai", genai_new.Client(api_key=os.environ.get("GOOGLE_API_KEY")))
evaluation/math_evaluation/latex2sympy/scripts/coverage.sh, line 11
if test -f .env/bin/activate
evaluation/math_evaluation/latex2sympy/scripts/coverage.sh, line 12
then source .env/bin/activate && echo "venv activate (bin)"
evaluation/math_evaluation/latex2sympy/scripts/coverage.sh, line 13
elif test -f .env/Scripts/activate
evaluation/math_evaluation/latex2sympy/scripts/coverage.sh, line 14
then source .env/Scripts/activate && echo "venv activated (Scripts)"
evaluation/math_evaluation/latex2sympy/scripts/setup.sh, line 12
else python3 -m venv .env && echo "venv created"
evaluation/math_evaluation/latex2sympy/scripts/setup.sh, line 18
if test -f .env/bin/activate
evaluation/math_evaluation/latex2sympy/scripts/setup.sh, line 19
then source .env/bin/activate && echo "venv activate (bin)"
label_skills/label_skills.py, line 38
client = OpenAI(api_key=os.environ.get("OPENAI_API_KEY"))
label_skills/label_skills.py, line 49
client = anthropic.Anthropic(api_key=os.environ.get("ANTHROPIC_API_KEY"))
label_skills/label_skills.py, line 70
genai.configure(api_key=os.environ.get("GOOGLE_API_KEY"))
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read.
OBFUSCATION_FILE_OVER_READ_CAP
evaluation/math_evaluation/latex2sympy/antlr-4.11.1-complete.jar, line 1
PK
evaluation/math_evaluation/latex2sympy/gen/PSParser.py, line 1
# Generated from PS.g4 by ANTLR 4.11.1
skill2_bench/skill2_bench_entropy_high_sequences_100_length_2-10_open_ended_0.3.json, line 1
[
Show more
skill2_bench/skill2_bench_entropy_low_sequences_100_length_2-10_open_ended_0.3.json, line 1
[
skill2_bench/skill2_bench_entropy_medium_sequences_100_length_2-10_open_ended_0.3.json, line 1
[
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 69eda2176c9a. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read.
Date and source
Date checked:
github.com
Commit graded: 69eda2176c9ac8ba8a756d68bc17685164542f2a
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.