Claude Code, Plugin
Skill Smith
Thin meta-skill that creates other Claude Code skills to an industry-leading, tested-real bar.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
SECRETS_PATH_CREDENTIAL
Why this grade
- SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
skills/skill-smith/scripts/fleet_check.py, line 308
path = os.path.expanduser("~/.ssh/config")
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
docs/diagrams/render.py, line 23
subprocess.run(command, check=True)
skills/skill-smith/assets/config/config_runtime.py, line 86
result = subprocess.run(["git", "-C", str(root), *args], capture_output=True,
skills/skill-smith/scripts/acceptance_gate.py, line 188
return subprocess.run(["git", "-C", str(root), *args], capture_output=True,
Show more
skills/skill-smith/scripts/check_config_conformance.py, line 59
return subprocess.run(command, capture_output=True, text=True,
skills/skill-smith/scripts/check_config_conformance.py, line 278
shutil.rmtree(scratch)
skills/skill-smith/scripts/check_conformance.py, line 427
p = subprocess.run(["git", "config", "--get", "fleet." + key], cwd=root,
skills/skill-smith/scripts/check_conformance.py, line 441
result = subprocess.run([sys.executable, checker, "--root", root, "--profile", "skill",
skills/skill-smith/scripts/check_conformance.py, line 512
staged = subprocess.run(["git", "ls-files", "-s", "--", ".githooks/pre-commit", ".githooks/pre-push"],
skills/skill-smith/scripts/check_conformance.py, line 517
hooks_path = subprocess.run(["git", "config", "--get", "core.hooksPath"], cwd=root,
Install and update
Concern
dependencies are not pinned.
INSTALL_UNPINNED
requirements.txt, line 1
PyYAML>=6
Network
Pass
No network call found.
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skills/skill-smith/assets/config/config_runtime.py, line 65
".env", "settings.env", "config/settings.env"):
skills/skill-smith/assets/config/init_config.py, line 27
*.env
skills/skill-smith/scripts/fleet_check.py, line 308
path = os.path.expanduser("~/.ssh/config")
Show more
skills/skill-smith/assets/config/init_config.py, line 28
!*.env.template
skills/skill-smith/assets/config/init_config.py, line 52
Per tool, `secrets/<slug>.env` holds the KEY=VALUE pairs its `tools/<slug>/env.template` lists.
skills/skill-smith/assets/config/init_config.py, line 172
print(" secrets/<slug>.env (ignored by default). Generate it from your credential store when you")
skills/skill-smith/scripts/check_config_conformance.py, line 188
if any(name.endswith(".env") for name in files):
skills/skill-smith/scripts/check_config_conformance.py, line 189
problems.append("local secrets/*.env exists")
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 43125acc375a. can delete files. dependencies are not pinned. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 43125acc375a6367746b2a7ac15c9892acf3bd82
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.