Claude Code, Skill
skills
Agent skills and an AGENTS.md workflow template — isolate in worktrees, build to a service layer, prove with evidence, ship with before/after proof and Greptile review loops.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 69558ea1f532.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST PERMISSION_SHELL_DECLARED
Why this grade
- NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
before-and-after/scripts/adapters/0x0st.sh, line 28
URL=$(curl -s -A "before-after-cli/1.0" -F "file=@$FILE" https://0x0.st) - NETWORK_UNNAMED_HOST Low
Calls a fixed host that the description does not name.
before-and-after/scripts/adapters/0x0st.sh, line 28
URL=$(curl -s -A "before-after-cli/1.0" -F "file=@$FILE" https://0x0.st) - PERMISSION_SHELL_DECLARED Note
Runs shell commands, and the manifest or description says so.
evidence-driven-testing/scripts/evidence.py, line 101
result = subprocess.run(
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Note
requests shell access. The manifest names this permission.
PERMISSION_SHELL_DECLARED
evidence-driven-testing/scripts/evidence.py, line 101
result = subprocess.run(
evidence-driven-testing/scripts/evidence.py, line 114
result = subprocess.run(
evidence-driven-testing/scripts/evidence.py, line 165
result = subprocess.run([tool], text=True, capture_output=True, check=False, timeout=5)
Show more
evidence-driven-testing/scripts/evidence.py, line 476
def spawn_detached(command: list[str], log_file: Any, env: dict[str, str]) -> subprocess.Popen[bytes]:
evidence-driven-testing/scripts/evidence.py, line 488
return subprocess.Popen(command, **kwargs)
evidence-driven-testing/scripts/evidence.py, line 561
result = subprocess.run(
evidence-driven-testing/scripts/evidence.py, line 673
def stop_child_gracefully(child: subprocess.Popen[bytes], grace_seconds: float) -> None:
evidence-driven-testing/scripts/evidence.py, line 719
child = subprocess.Popen(command, stdout=log_file, **kwargs)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address. can reach 0x0.st. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
before-and-after/scripts/adapters/0x0st.sh, line 28
URL=$(curl -s -A "before-after-cli/1.0" -F "file=@$FILE" https://0x0.st)
before-and-after/scripts/adapters/blob.sh, line 39
RESPONSE=$(curl -s -X POST -F "file=@$FILE" "$BLOB_UPLOAD_URL")
Secrets
Pass
No read of a credential file or secret environment variable found.
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Note
no licence file found.
LICENCE_MISSING
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 69558ea1f532. requests shell access. The manifest names this permission. can reach a host that is not written as a fixed address. can reach 0x0.st. The description does not name that host. no licence file found.
Date and source
Date checked:
github.com
Commit graded: 69558ea1f5328da7b40ba171dfe2171f00ff4884
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.