Grades are a hygiene check, not a security guarantee.

Claude Code, Skill

skills

44 skills: a clean-prose engine with an offline linter, wrappers for viral posts, essays, cold email and landing copy, and orchestrators that carry a job from research question to published carousel or reel.

Compatibility: Not stated.

Grade B

Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV INSTALL_DOCUMENTED_INSTALLER SECRETS_ENV_READ OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED

Why this grade

  • PERMISSION_DELETE_FILES Low

    Contains a call that can delete files.

    common/runners/cctv_overlay.py, line 74 probe = subprocess.run(["ffprobe", "-v", "error", "-select_streams", "v:0", "-show_entries",

  • NETWORK_NO_FIXED_HOST Low

    Makes a network call whose host is not written as a fixed address.

    install.sh, line 118 require_cmd curl tar

  • NETWORK_UNNAMED_HOST Low

    Calls a fixed host that the description does not name.

    install.sh, line 118 require_cmd curl tar

  • SECRETS_PATH_DOTENV Low

    Mentions a .env file.

    common/runners/errors.py, line 19 f"Set them in your shell (.zshrc/.bashrc) or source a .env file."

  • INSTALL_DOCUMENTED_INSTALLER Note

    Documentation shows an installer that pipes a download into a shell.

    README.md, line 116 curl -fsSL https://raw.githubusercontent.com/Mikefluff/skills/main/install.sh | bash

  • SECRETS_ENV_READ Note

    Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.

    common/runners/keysfile.py, line 23 KEYS_FILE = Path(os.environ.get("SKILLS_KEYS_FILE", str(Path.home() / ".skills.env")))

  • OBFUSCATION_FILE_OVER_READ_CAP Note

    A file was over the read cap and was not fully read.

    CHANGELOG.md, line 1 # Changelog

  • OBFUSCATION_FILE_CAP_REACHED Note

    The 400 file cap was reached before every file was read.

    CHANGELOG.md, line 1 # Changelog

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Concern

    can delete files.

    PERMISSION_DELETE_FILES

    common/runners/cctv_overlay.py, line 74

    probe = subprocess.run(["ffprobe", "-v", "error", "-select_streams", "v:0", "-show_entries",

    common/runners/cctv_overlay.py, line 81

    reader = subprocess.Popen([ffmpeg_bin, "-loglevel", "error", "-i", str(video), "-f", "rawvideo",

    common/runners/cctv_overlay.py, line 83

    writer = subprocess.Popen([ffmpeg_bin, "-y", "-loglevel", "error", "-f", "rawvideo", "-pix_fmt", "rgb24",

    Show more

    common/runners/ffmpeg.py, line 106

    out = subprocess.run(

    common/runners/ffmpeg.py, line 143

    subprocess.run(cmd, check=True, capture_output=True, text=True)

    common/runners/ffmpeg.py, line 229

    subprocess.run(cmd, check=True, capture_output=True, text=True)

    common/runners/ffmpeg.py, line 270

    subprocess.run(cmd, check=True, capture_output=True, text=True)

    common/runners/ffmpeg.py, line 281

    subprocess.run(cmd, check=True, capture_output=True, text=True)

    common/runners/cli/reel_previs.py, line 86

    shutil.rmtree(frames)

  • Install and update

    Note

    README documents an installer that pipes a download into a shell. The docs document an installer that pipes a download into a shell.

    INSTALL_DOCUMENTED_INSTALLER

    README.md, line 116

    curl -fsSL https://raw.githubusercontent.com/Mikefluff/skills/main/install.sh | bash

    install.sh, line 5

    # curl -fsSL https://raw.githubusercontent.com/Mikefluff/skills/main/install.sh | bash

    install.sh, line 6

    # curl -fsSL https://raw.githubusercontent.com/Mikefluff/skills/main/install.sh | bash -s -- --skills writer,viral-text

    Show more

    docs/FAQ.md, line 20

    curl -fsSL https://raw.githubusercontent.com/Mikefluff/skills/main/install.sh | bash -s -- --skills writer,viral-text

    docs/INSTALL.md, line 8

    curl -fsSL https://raw.githubusercontent.com/Mikefluff/skills/main/install.sh | bash

    docs/INSTALL.md, line 25

    curl -fsSL https://raw.githubusercontent.com/Mikefluff/skills/main/install.sh | bash -s -- --prefix /opt/skills

    docs/INSTALL.md, line 31

    curl -fsSL https://raw.githubusercontent.com/Mikefluff/skills/main/install.sh | bash -s -- --skills writer,viral-text,landing-copy

    docs/INSTALL.md, line 112

    curl -fsSL https://raw.githubusercontent.com/Mikefluff/skills/main/install.sh | bash -s -- --update

    docs/QUICKSTART.md, line 10

    curl -fsSL https://raw.githubusercontent.com/Mikefluff/skills/main/install.sh | bash

    docs/QUICKSTART.md, line 125

    curl -fsSL https://raw.githubusercontent.com/Mikefluff/skills/main/install.sh | bash

    docs/USER-GUIDE.md, line 8

    curl -fsSL https://raw.githubusercontent.com/Mikefluff/skills/main/install.sh | bash

    docs/launch-posts/linkedin.md, line 27

    curl -fsSL https://raw.githubusercontent.com/Mikefluff/skills/main/install.sh | bash

    docs/launch-posts/reddit.md, line 32

    curl -fsSL https://raw.githubusercontent.com/Mikefluff/skills/main/install.sh | bash

    docs/launch-posts/substack.md, line 99

    curl -fsSL https://raw.githubusercontent.com/Mikefluff/skills/main/install.sh | bash

    docs/launch-posts/x-thread.md, line 105

    curl -fsSL https://raw.githubusercontent.com/Mikefluff/skills/main/install.sh | bash

    docs/walkthroughs/research-to-carousel-reel.md, line 31

    curl -fsSL https://raw.githubusercontent.com/Mikefluff/skills/main/install.sh | bash

    .github/workflows-template/skills-lint.yml.template, line 120

    echo "curl -fsSL https://raw.githubusercontent.com/Mikefluff/skills/main/install.sh | bash" >> "$GITHUB_STEP_SUMMARY"

    skills/skills-update/SKILL.md, line 90

    curl -fsSL https://raw.githubusercontent.com/Mikefluff/skills/main/install.sh | bash -s -- --update

    skills/skills-update/SKILL.md, line 112

    curl -fsSL https://raw.githubusercontent.com/Mikefluff/skills/main/install.sh | bash

    skills/skills-update/examples/before-after.md, line 120

    Running: curl -fsSL https://raw.githubusercontent.com/Mikefluff/skills/main/install.sh | bash -s -- --update

    skills/skills-update/examples/before-after.md, line 183

    bash -c 'curl -fsSL https://raw.githubusercontent.com/Mikefluff/skills/main/install.sh | bash -s -- --update'

  • Network

    Concern

    can reach a host that is not written as a fixed address. can reach api.github.com. The description does not name that host.

    NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

    install.sh, line 118

    require_cmd curl tar

    install.sh, line 123

    TARGET_VERSION="$(curl -fsSL "https://api.github.com/repos/${REPO_SLUG}/releases/latest" | jq -r '.tag_name')"

    install.sh, line 125

    TARGET_VERSION="$(curl -fsSL "https://api.github.com/repos/${REPO_SLUG}/releases/latest" | grep -m1 '"tag_name"' | sed -E 's/.*"tag_name": *"([^"]+)".*/\1/')"

    Show more

    install.sh, line 140

    if ! curl -fsSL "$TARBALL_URL" -o "$TMPDIR/skills.tar.gz"; then

    install.sh, line 451

    tag="$(curl -fsSL "https://api.github.com/repos/${REPO_SLUG}/releases/latest" | jq -r '.tag_name' 2>/dev/null || true)"

    install.sh, line 453

    tag="$(curl -fsSL "https://api.github.com/repos/${REPO_SLUG}/releases/latest" | grep -m1 '"tag_name"' | sed -E 's/.*"tag_name": *"([^"]+)".*/\1/' || true)"

    common/runners/oauth.py, line 229

    resp = requests.post(

    common/runners/verify.py, line 31

    with urllib.request.urlopen(req, timeout=timeout) as resp:

  • Secrets

    Concern

    reads a credential or environment file.

    SECRETS_ENV_READ SECRETS_PATH_DOTENV

    common/runners/errors.py, line 19

    f"Set them in your shell (.zshrc/.bashrc) or source a .env file."

    common/runners/keysfile.py, line 23

    KEYS_FILE = Path(os.environ.get("SKILLS_KEYS_FILE", str(Path.home() / ".skills.env")))

    common/runners/tokens.py, line 34

    TOKENS_FILE = Path(os.environ.get("SKILLS_TOKENS_FILE", str(Path.home() / ".skills-tokens.json")))

    Show more

    common/runners/publishers/linkedin.py, line 227

    "client_secret": os.environ.get("LINKEDIN_CLIENT_SECRET", ""),

    common/runners/publishers/telegraph.py, line 136

    existing = os.environ.get("TELEGRAPH_ACCESS_TOKEN")

    common/runners/publishers/telegraph.py, line 170

    minted = not os.environ.get("TELEGRAPH_ACCESS_TOKEN")

    common/runners/publishers/tiktok.py, line 361

    "client_key": os.environ.get("TIKTOK_CLIENT_KEY", ""),

    common/runners/publishers/tiktok.py, line 362

    "client_secret": os.environ.get("TIKTOK_CLIENT_SECRET", ""),

    common/runners/publishers/x.py, line 254

    auth=(os.environ.get("X_CLIENT_ID", ""), os.environ.get("X_CLIENT_SECRET", "")),

    CHANGELOG.md, line 1939

    - `.env.example` mentions auto-install.

    CHANGELOG.md, line 1993

    - **`.env.example`** at repo root - full env-var matrix with per-provider

    README.md, line 127

    **API keys** (for `--execute` mode - entirely optional): manage via `/skills-keys add OPENAI_API_KEY ...` inside Claude Code, or copy `.env.example` to `~/.skills.env`. See [Managi

    README.md, line 366

    ├── .env.example # template for ~/.skills.env (manage via /skills-keys)

    common/runners/README.md, line 22

    Copy `.env.example` from the repo root, fill in the keys you actually have, and source it:

    common/runners/README.md, line 25

    cp .env.example ~/.skills.env

    docs/README.md, line 64

    - [`.env.example`](../.env.example) - template for `~/.skills.env` (manage via `/skills-keys`)

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Note

    a file was over the read cap and was not fully read. the file cap was reached before every file was read.

    OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED

    CHANGELOG.md, line 1

    # Changelog

    skills/essay-write/references/plain-russian.md, line 1

    # PLAIN-RUSSIAN COMPLEX CONTENT

  • Licence

    Pass

    A licence file is present (LICENSE).

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit bbab3d82df33. can delete files. README documents an installer that pipes a download into a shell. The docs document an installer that pipes a download into a shell. can reach a host that is not written as a fixed address. can reach api.github.com. The description does not name that host. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.

Date and source

Date checked:

View source

github.com

Commit graded: bbab3d82df330d964c932386158db1a25c24a149

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen