Claude Code, Skill
skillevaluation
Part of DecimalAI.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
SECRETS_PATH_CREDENTIAL
Why this grade
- SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
skillevaluation/safety.py, line 73
# (`id_rsa.pub`), a relative module import (`./cookies.js`) and a project's
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
skillevaluation/runner/orchestrator.py, line 314
shutil.rmtree(ws, ignore_errors=True)
skillevaluation/runner/validators.py, line 103
probe = subprocess.run(
skillevaluation/runner/validators.py, line 112
"""Return ``(args, shell)`` for subprocess.run, applying network isolation when enabled."""
Show more
skillevaluation/runner/validators.py, line 204
proc = subprocess.run(
skillevaluation/runner/workspace.py, line 112
proc = subprocess.run(
skillevaluation/runner/adapters/claude_code.py, line 101
shutil.rmtree(skills_root, ignore_errors=True)
skillevaluation/runner/adapters/claude_code.py, line 120
proc = subprocess.run(
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach tool.dev. The description does not name that host. can reach a host that is not written as a fixed address. can reach x. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
scripts/release.sh, line 38
HTTP="$(curl -s -o /dev/null -w '%{http_code}' "https://pypi.org/pypi/$NAME/$VERSION/json" || echo 000)"
scripts/release.sh, line 76
curl -s -o /dev/null -w " https://pypi.org/pypi/$NAME/$VERSION/json -> HTTP %{http_code}\n" \
skillevaluation/safety.py, line 182
# separately (see `_PIPE_TO_SHELL` + the scan body) because `curl https://tool.dev/
Show more
skillevaluation/safety.py, line 189
# `bash -c "$(curl …)"` / `iex(…DownloadString)` ARE documented installers and are
skillevaluation/safety.py, line 192
# Decode-and-execute: `echo <b64> | base64 -d | bash`, `curl … | base64 -d | sh`,
skillevaluation/safety.py, line 206
# `bash -c "$(curl …)"`, PowerShell `iex(…DownloadString(URL))`. Each captures the
skillevaluation/safety.py, line 217
"shell -c $(curl …)",
skillevaluation/safety.py, line 298
# `requests.post(…)` and a bare `curl …` are not quoted at all. And a stealer's target
skillevaluation/safety.py, line 325
# match inside other words. `"curl -F x"` is still not a name.
skillevaluation/safety.py, line 343
# other words), but only where the quotes still bound one item, so that `"$U" curl "$V"`
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skillevaluation/safety.py, line 73
# (`id_rsa.pub`), a relative module import (`./cookies.js`) and a project's
skillevaluation/safety.py, line 251
# * A PUBLIC key. `id_rsa.pub` / `~/.ssh/id_ed25519.pub` is the half you hand out; a git
skillevaluation/safety.py, line 252
# setup script that checks `[ -f ~/.ssh/id_rsa.pub ]` reads no secret.
Show more
skillevaluation/safety.py, line 257
# environment config there, as `.env` holds a project's settings, which this list leaves
skillevaluation/safety.py, line 262
r"(?i)(~/\.ssh/id_(?![\w-]*\.pub\b)|id_rsa\b(?!\.pub\b)|id_ed25519\b(?!\.pub\b)|"
skillevaluation/safety.py, line 263
r"\.aws/credentials|\.config/gcloud|"
skillevaluation/safety.py, line 267
r"keystore\b|/etc/shadow|\.npmrc\b|\.pypirc\b|\.docker/config\.json)"
skillevaluation/safety.py, line 303
# whitespace, no shell or URL syntax. `"/etc/shadow"`, `'id_rsa'`, `"/usr/bin/curl"`,
skillevaluation/runner/cli.py, line 374
token = os.environ.get("SKILLEVAL_EXPORT_TOKEN")
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains an encoded blob in a file that should be readable.
OBFUSCATION_ENCODED_BLOB
research/skill-lift-across-models/skill_lift_cases.csv, line 1
skill_slug,runner_model,run_id,case_id,case_name,outcome,with_skill_passed,without_skill_passed,prompt_is_snapshot,outputs_pruned,case_prompt
compatibility-tests/trajectory/tool-output-truncation/expected.txt, line 2
[Step 2] Tool output: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
compatibility-tests/trajectory/tool-output-truncation/input.json, line 18
"output_preview": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 11c0b13d339f. can delete files. can reach tool.dev. The description does not name that host. can reach a host that is not written as a fixed address. can reach x. The description does not name that host. reads a credential or environment file. contains an encoded blob in a file that should be readable.
Date and source
Date checked:
github.com
Commit graded: 11c0b13d339f6b56952720b3b568899310b251fa
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.