Claude Code, Skill
skills
Skills shared by soulmachine for improving daily work efficiency with AI Agents (Claude Code, Codex, etc.).
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
SECRETS_PATH_CREDENTIAL
Why this grade
- SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
cua-macos-lume-sandbox/scripts/provision.sh, line 169
for k in "$HOME/.ssh/id_ed25519.pub" "$HOME/.ssh/id_rsa.pub"; do
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
chrome-cdp-setup/scripts/setup_chrome_cdp.sh, line 29
if subprocess.run(["pgrep", "-x", "Google Chrome"], capture_output=True).returncode != 0:
chrome-cdp-setup/scripts/setup_chrome_cdp.sh, line 32
subprocess.run(["pkill", "-x", "Google Chrome"])
chrome-cdp-setup/scripts/setup_chrome_cdp.sh, line 211
subprocess.run(["defaults", "import", "com.apple.dock", path], check=True)
Show more
chrome-cdp-setup/scripts/setup_chrome_cdp.sh, line 215
old = subprocess.run(["pgrep", "-x", "Dock"], capture_output=True, text=True).stdout.strip()
chrome-cdp-setup/scripts/setup_chrome_cdp.sh, line 216
subprocess.run(["killall", "Dock"])
chrome-cdp-setup/scripts/setup_chrome_cdp.sh, line 218
new = subprocess.run(["pgrep", "-x", "Dock"], capture_output=True, text=True).stdout.strip()
chrome-cdp-setup/scripts/setup_chrome_cdp.sh, line 219
if new and new != old and b"pid" in subprocess.run(["lsappinfo", "info", "-app", "com.apple.dock"], capture_output=True).stdout:
deploy-kimi-k3-on-rtx-pro-6000/scripts/quality_eval.py, line 77
p = subprocess.run([py, fn], capture_output=True, timeout=10)
herdr-rename-hook/scripts/herdr-rename-agent.sh, line 516
os.remove(claim)
macos-multi-instances/scripts/multi_app.py, line 92
shutil.rmtree(dst) # the bundle holds no user data; that lives in the container
macos-multi-instances/scripts/multi_app.py, line 95
shutil.rmtree(dst / "Contents/PlugIns", ignore_errors=True)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address. can reach github.com. The description does not name that host. can reach www.asus.com. The description does not name that host. can reach cua.ai. The description does not name that host. can reach h. The description does not name that host. can reach gist.githubusercontent.com. The description does not name that host. can reach huggingface.co. The description does not name that host. can reach archive.ubuntu.com. The description does not n
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST NETWORK_NAMED_HOST
affix-domains/scripts/check_domains.sh, line 46
code=$(curl -s -o /dev/null -w "%{http_code}" --max-time 15 "${2}${1}")
affix-domains/scripts/check_github.sh, line 44
code=$(curl -s -o /dev/null -w "%{http_code}" --max-time 15 "https://github.com/$1")
affix-domains/scripts/check_x.sh, line 72
body=$(curl -s -w '\n%{http_code}' --max-time 15 \
Show more
apple-design/scripts/pull_hig.py, line 33
def fetch(slug, cache):
apple-design/scripts/pull_hig.py, line 38
with urllib.request.urlopen(urllib.request.Request(url, headers={"User-Agent": "pull_hig.py"}), timeout=60) as r:
apple-design/scripts/pull_hig.py, line 57
root = fetch("", cache)
apple-design/scripts/pull_hig.py, line 62
docs = pool.map(lambda s: fetch(s, cache), frontier)
asus-esc8000-firmware-upgrade/scripts/bmc_update.sh, line 15
ET=$(curl -ksm 10 -u "$A" -o /dev/null -D - "$B/UpdateService" | awk -F': ' 'tolower($1)=="etag"{gsub(/\r/,"");print $2}')
chrome-cdp-setup/scripts/setup_chrome_cdp.sh, line 228
curl -s --retry 30 --retry-delay 1 --retry-all-errors "http://127.0.0.1:$PORT/json/version" \
chrome-cdp-setup/scripts/verify_cdp.sh, line 12
HTTP=$(curl -s -o "$BODY" -w '%{http_code}' --max-time 5 "http://127.0.0.1:$PORT/json/version")
deploy-kimi-k3-on-rtx-pro-6000/scripts/smoke_test.sh, line 34
if curl -sf "http://127.0.0.1:${PORT}/health" >/dev/null 2>&1; then ok=1; break; fi
deploy-kimi-k3-on-rtx-pro-6000/scripts/smoke_test.sh, line 45
resp="$(curl -sf "http://127.0.0.1:${PORT}/v1/chat/completions" \
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL
asus-esc8000-firmware-upgrade/scripts/bios_update.py, line 56
password = os.environ.get("BMC_PASSWORD") or sys.exit("set BMC_PASSWORD env var")
asus-esc8000-gpu-bios-tuning/scripts/tune_gpu_bios.py, line 55
pw = os.environ.get("BMC_PASSWORD") or sys.exit("set BMC_PASSWORD")
cua-macos-lume-sandbox/scripts/provision.sh, line 169
for k in "$HOME/.ssh/id_ed25519.pub" "$HOME/.ssh/id_rsa.pub"; do
Show more
cua-macos-lume-sandbox/scripts/provision.sh, line 175
grep -qxF '$PUBKEY' ~/.ssh/authorized_keys 2>/dev/null || echo '$PUBKEY' >> ~/.ssh/authorized_keys
cua-macos-lume-sandbox/scripts/provision.sh, line 176
chmod 600 ~/.ssh/authorized_keys" || warn "could not install public key"
cua-macos-lume-sandbox/scripts/provision.sh, line 178
warn "no ~/.ssh/id_ed25519.pub or id_rsa.pub found - the MCP wrapper needs key auth (ssh-keygen -t ed25519)"
refresh-claude-account/SKILL.md, line 273
| **Storage** | macOS: encrypted Keychain (`Claude Code-credentials`). Linux: `~/.claude/.credentials.json` (mode 0600). Windows: `%USERPROFILE%\.claude\.credentials.json`. Rewritt
refresh-claude-account/SKILL.md, line 309
the keychain on one machine and in `~/.claude/.credentials.json` on another).
ssh-claude-auth/SKILL.md, line 13
- On macOS the keychain is the credential's *intended* home; `~/.claude/.credentials.json` is not the supported Linux-style alternative you can simply opt into.
ssh-claude-auth/SKILL.md, line 15
**But do not read that second point as "the file never exists on macOS."** It does, and mistaking its presence for a healthy configuration wastes hours. `cswap` degrades to writing
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 82a75a374041. can delete files. can reach a host that is not written as a fixed address. can reach github.com. The description does not name that host. can reach www.asus.com. The description does not name that host. can reach cua.ai. The description does not name that host. can reach h. The description does not name that host. can reach gist.githubusercontent.com. The description does not name that host. can reach huggingface.co. The description does not name that host. can reach archive.ubuntu.com. The description does not n reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 82a75a37404179059e954b094fd89210d18f5af3
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.