Claude Code, Plugin
skills
skills, a plugin listed in the PlugVet directory.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit fc21ef60c6f1, unchanged since the check below.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV
Why this grade
- NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
json-ld/scripts/extract-jsonld.mjs, line 5
* file argument or stdin (pipe curl into it yourself). - NETWORK_UNNAMED_HOST Low
Calls a fixed host that the description does not name.
json-ld/scripts/extract-jsonld.mjs, line 5
* file argument or stdin (pipe curl into it yourself). - SECRETS_PATH_DOTENV Low
Mentions a .env file.
shopify-upgrade/scripts/detect-versions.mjs, line 10
* .env value, and a raw URL string like "/admin/api/2024-10/graphql.json" in
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address. can reach shopify.dev. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
json-ld/scripts/extract-jsonld.mjs, line 5
* file argument or stdin (pipe curl into it yourself).
json-ld/scripts/extract-jsonld.mjs, line 8
* curl -s http://localhost:3000/page | node extract-jsonld.mjs
shopify-upgrade/scripts/changelog-scan.mjs, line 8
* curl -sSL https://shopify.dev/changelog -o changelog.html
Show more
shopify-upgrade/scripts/changelog-scan.mjs, line 14
* entries for ?page=2, ?page=5 and no params at all, so curl pagination
shopify-upgrade/scripts/changelog-scan.mjs, line 23
* curl -sSL https://shopify.dev/changelog/<slug>.md
shopify-upgrade/scripts/changelog-scan.mjs, line 27
* curl -sSL https://shopify.dev/changelog | node changelog-scan.mjs [options]
shopify-upgrade/scripts/changelog-scan.mjs, line 227
curl -sSL https://shopify.dev/changelog -o changelog.html
compliance-pages/references/codebase-scan.md, line 39
- **Outbound calls in code**: `fetch(`/`axios`/`XMLHttpRequest`/`navigator.sendBeacon` to non-first-party hosts, `new Image().src = "https://…`.
shopify-upgrade/SKILL.md, line 85
Fetch the changelog index **once**, then filter it locally with `scripts/changelog-scan.mjs` - it tags every entry `Breaking change` / `Action required` / `Update` / `Note` and lab
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
shopify-upgrade/scripts/detect-versions.mjs, line 10
* .env value, and a raw URL string like "/admin/api/2024-10/graphql.json" in
shopify-upgrade/scripts/detect-versions.mjs, line 82
".graphql", ".gql", ".sh", ".bash", ".zsh", ".env", ".ini", ".cfg", ".conf",
shopify-upgrade/scripts/detect-versions.mjs, line 225
"Gemfile", "Dockerfile", "Makefile", "Procfile", "requirements.txt", ".env",
Show more
shopify-upgrade/scripts/detect-versions.mjs, line 233
const HIGH_SIGNAL_FILE = /^(shopify\.app.*\.toml|shopify(\.[a-z0-9]+)*\.extension\.toml|shopify\.theme\.toml|\.env.*|shopify\.server\..*)$/i;
shopify-upgrade/scripts/detect-versions.mjs, line 617
const ok = TEXT_EXT.has(ext) || EXTRA_FILES.has(e.name) || e.name.startsWith(".env") || ext === "";
shopify-upgrade/README.md, line 69
| **1 · Detect** | Sweeps for `YYYY-MM` version literals in **any language** - TS constant, TOML key, `.env` value, Python positional arg, raw URL string - then resolves each SDK's
shopify-upgrade/SKILL.md, line 177
- **Match the codebase.** Version constants stay wherever the project already keeps them (`.env`, `shopify.app.toml`, a config module, a Docker env). Never introduce a new configur
shopify-upgrade/references/detection.md, line 13
The script is language-agnostic on purpose. A Shopify API version is always `YYYY-MM` with MM ∈ {01,04,07,10}, so one pattern finds a TypeScript constant, a TOML key, a `.env` valu
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit fc21ef60c6f1. can reach a host that is not written as a fixed address. can reach shopify.dev. The description does not name that host. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: fc21ef60c6f1fc029589ed3bb15be7456b6695f9
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.