Grades are a hygiene check, not a security guarantee.

Claude Code, Skill

skills

skills, a skill listed in the PlugVet directory.

Compatibility: Not stated.

Grade B

Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV OBFUSCATION_FILE_OVER_READ_CAP

Why this grade

  • PERMISSION_DELETE_FILES Low

    Contains a call that can delete files.

    awwwards/scripts/shoot.mjs, line 423 for (const f of fs.readdirSync(out)) if (f.endsWith('.png')) fs.rmSync(path.join(out, f));

  • NETWORK_NO_FIXED_HOST Low

    Makes a network call whose host is not written as a fixed address.

    awwwards/scripts/audit.mjs, line 55 const r = await fetch(u, { redirect: 'follow' });

  • NETWORK_UNNAMED_HOST Low

    Calls a fixed host that the description does not name.

    awwwards/scripts/audit.mjs, line 55 const r = await fetch(u, { redirect: 'follow' });

  • SECRETS_PATH_DOTENV Low

    Mentions a .env file.

    .gitignore, line 39 .env

  • OBFUSCATION_FILE_OVER_READ_CAP Note

    A file was over the read cap and was not fully read.

    tests/nexttest/package-lock.json, line 1 {

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Concern

    can delete files.

    PERMISSION_DELETE_FILES

    awwwards/scripts/shoot.mjs, line 423

    for (const f of fs.readdirSync(out)) if (f.endsWith('.png')) fs.rmSync(path.join(out, f));

    jury/scripts/shoot.mjs, line 422

    for (const f of fs.readdirSync(out)) if (f.endsWith('.png')) fs.rmSync(path.join(out, f));

  • Install and update

    Pass

    No install-time script found, and dependencies are pinned or absent.

  • Network

    Concern

    can reach a host that is not written as a fixed address. can reach picsum.photos. The description does not name that host.

    NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

    awwwards/scripts/audit.mjs, line 55

    const r = await fetch(u, { redirect: 'follow' });

    awwwards/scripts/audit.mjs, line 239

    // Let Node exit on its own: process.exit() right after fetch() aborts Node on Windows (libuv

    awwwards/scripts/font.mjs, line 37

    const res = await fetch(cssUrl, { headers: { 'user-agent': UA } });

    Show more

    awwwards/scripts/font.mjs, line 63

    const buf = Buffer.from(await (await fetch(src.startsWith('//') ? `https:${src}` : src, { headers: { 'user-agent': UA } })).arrayBuffer());

    awwwards/scripts/photos.mjs, line 18

    const r = await fetch(`https://picsum.photos/v2/list?page=${p}&limit=100`);

    awwwards/scripts/photos.mjs, line 53

    const info = await (await fetch(`https://picsum.photos/id/${id}/info`)).json();

    awwwards/scripts/photos.mjs, line 54

    const img = await fetch(`https://picsum.photos/id/${id}/${w}/${h}`);

    awwwards/scripts/shoot.mjs, line 40

    const r = await fetch(AXE_CDN.url);

  • Secrets

    Concern

    reads a credential or environment file.

    SECRETS_PATH_DOTENV

    .gitignore, line 38

    # Local environment and logs

    .gitignore, line 39

    .env

    .gitignore, line 41

    !.env.example

    Show more

    .gitignore, line 42

    !.env.sample

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Note

    a file was over the read cap and was not fully read.

    OBFUSCATION_FILE_OVER_READ_CAP

    tests/nexttest/package-lock.json, line 1

    {

  • Licence

    Pass

    A licence file is present (LICENSE).

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit add880bd6ec9. can delete files. can reach a host that is not written as a fixed address. can reach picsum.photos. The description does not name that host. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked:

View source

github.com

Commit graded: add880bd6ec9f5592a1482846fc0dd282c9161bc

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen