Grades are a hygiene check, not a security guarantee.

Claude Code, Skill

skills

skills, a skill listed in the PlugVet directory.

Compatibility: Not stated.

Grade B

Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV PERMISSION_SHELL_DECLARED

Why this grade

  • NETWORK_NO_FIXED_HOST Low

    Makes a network call whose host is not written as a fixed address.

    video-summary/scripts/fetch_transcript.py, line 111 with urllib.request.urlopen(req, timeout=timeout) as resp:

  • SECRETS_PATH_DOTENV Low

    Mentions a .env file.

    learn-by-running-code/scripts/validate_learning_repo.py, line 151 real_env = repo / ".env"

  • PERMISSION_SHELL_DECLARED Note

    Runs shell commands, and the manifest or description says so.

    learn-by-running-code/scripts/test_validate_repos.py, line 206 patch("subprocess.run", side_effect=AssertionError("must not execute commands")),

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Note

    requests shell access. The manifest names this permission.

    PERMISSION_SHELL_DECLARED

    learn-by-running-code/scripts/test_validate_repos.py, line 206

    patch("subprocess.run", side_effect=AssertionError("must not execute commands")),

    video-summary/scripts/fetch_transcript.py, line 304

    proc = subprocess.run(cmd, capture_output=True, text=True, timeout=300)

    video-summary/scripts/fetch_transcript.py, line 470

    proc = subprocess.run(cmd, capture_output=True, text=True, timeout=180)

  • Install and update

    Pass

    No install-time script found, and dependencies are pinned or absent.

  • Network

    Concern

    can reach a host that is not written as a fixed address.

    NETWORK_NO_FIXED_HOST

    video-summary/scripts/fetch_transcript.py, line 111

    with urllib.request.urlopen(req, timeout=timeout) as resp:

    video-summary/scripts/fetch_transcript.py, line 137

    with urllib.request.urlopen(req, timeout=timeout) as resp:

  • Secrets

    Concern

    reads a credential or environment file.

    SECRETS_PATH_DOTENV

    learn-by-running-code/scripts/validate_learning_repo.py, line 151

    real_env = repo / ".env"

    learn-by-running-code/scripts/validate_learning_repo.py, line 153

    warnings.append(".env exists; ensure it is ignored and never contains committed secrets")

    learn-by-running-code/SKILL.md, line 84

    - 关键路径不留伪代码、未定义占位函数；只为稳定复用代码建立 `shared/`。密钥仅用假值 `.env.example`。

    Show more

    learn-by-running-code/assets/README.template.md, line 48

    不要把真实密钥提交到 Git。需要环境变量时，从 `.env.example` 复制变量名并在本地 `.env` 中填写。

    learn-by-running-code/assets/gitignore.template, line 1

    .venv/

    learn-by-running-code/references/project-contract.md, line 51

    开发验证只在安全临时目录或批准环境进行；记录真实数据和替身的边界。不要将大模型、私有样本、日志中的敏感字段或真实 `.env` 随代码提交。

    learn-by-running-code/references/repository-contract.md, line 14

    | `.gitignore` | 至少忽略 `.venv/`、`.env`、缓存和构建产物 |

    learn-by-running-code/references/repository-contract.md, line 17

    只有实际需要环境变量时才创建 `.env.example`；只有多个章节确实复用同一稳定实现时才创建 `shared/`。

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Pass

    No encoded or minified payload found.

  • Licence

    Pass

    A licence file is present (LICENSE).

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 8a3c81897857. requests shell access. The manifest names this permission. can reach a host that is not written as a fixed address. reads a credential or environment file.

Date and source

Date checked:

View source

github.com

Commit graded: 8a3c81897857d02014022e97e605e02f85327d36

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen