Claude Code, Skill
solidforge
A Loop Engineering system for AI coding agents — one Claude Code plugin.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
NETWORK_HOST_FROM_INPUT
Why this grade
- NETWORK_HOST_FROM_INPUT Medium
A file takes a URL or endpoint as input and has no fixed host list.
skills/parallel-development/infra/scripts/arch_contract_api.py, line 237
# fetch("..."), axios.get("..."), axios.post(`...`), ... - first string/template arg.
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
skills/cross-source-review/infra/scripts/csr_progress.py, line 226
os.remove(tmp)
skills/cross-source-review/infra/scripts/hetero_doc_review.py, line 219
# subprocess.run buffers it again, so a 20-minute run was indistinguishable from
skills/cross-source-review/infra/scripts/hetero_doc_review.py, line 727
proc = subprocess.Popen(
Show more
skills/cross-source-review/infra/scripts/hetero_doc_review.py, line 903
`guards` kwarg is ADDITIVE (None = legacy json spawn via subprocess.run; a dict
skills/cross-source-review/infra/scripts/hetero_doc_review.py, line 959
proc = subprocess.run(
skills/cross-source-review/infra/scripts/hetero_doc_review.py, line 1349
"incremental telemetry / heartbeat / byte cap (subprocess.run full-buffer). "
skills/cross-source-review/infra/scripts/hetero_doc_review.py, line 1415
# subprocess.run(None). Same footgun pre-existed in pd for --dry-run-malform; carried over.
skills/cross-source-review/infra/scripts/converge_fixtures/verify.py, line 78
r = subprocess.run(
skills/parallel-development/infra/hooks/counters.py, line 42
proc = subprocess.run(
skills/parallel-development/infra/install/arm.py, line 1092
os.remove(os.path.join(project_dir, name))
skills/parallel-development/infra/install/arm.py, line 1126
os.remove(os.path.join(project_dir, name))
skills/parallel-development/infra/install/arm.py, line 1167
shutil.rmtree(p, ignore_errors=True)
skills/parallel-development/infra/install/arm.py, line 1174
os.remove(p)
skills/parallel-development/infra/install/arm.py, line 1195
os.remove(dst)
skills/parallel-development/infra/scripts/snapshot.py, line 199
shutil.rmtree(base, ignore_errors=True)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Serious
accepts a host from input, with no fixed list in this file.
NETWORK_HOST_FROM_INPUT
skills/parallel-development/infra/scripts/arch_contract_api.py, line 237
# fetch("..."), axios.get("..."), axios.post(`...`), ... - first string/template arg.
skills/parallel-development/infra/templates/cold-start-patterns/async-concurrency-baseline.md, line 15
return requests.get(url).json()
skills/parallel-development/references/e2e-patterns.md, line 80
├─ curl API → returns data?
Show more
skills/parallel-development/references/e2e-testing.md, line 46
curl -I http://localhost/dianginx/
skills/parallel-development/references/python-patterns.md, line 638
result = requests.get(url) # synchronous HTTP in async handler
skills/parallel-development/references/agent-patterns/devops-engineer.md, line 32
CMD curl -f http://localhost/health || exit 1
skills/primary-source-verification/infra/scripts/fetch_source.py, line 33
def fetch(url: str, timeout: int = 30) -> tuple[str | None, str]:
skills/primary-source-verification/infra/scripts/fetch_source.py, line 37
with urllib.request.urlopen(req, timeout=timeout) as resp:
skills/primary-source-verification/infra/scripts/fetch_source.py, line 58
body, status = fetch(args.url, args.timeout)
agents/web-claim-verifier.agent.md, line 79
This contract's OWN extension (the exemplar is per-claim verdict only). NO top-level `verdict`; a `findings[]` array whose every element carries the grounding block (`quote`, `url`
docs/intent-blueprints/_templates/cold-start-patterns/async-concurrency-baseline.md, line 15
return requests.get(url).json()
docs/web-claim-verifier-proposal.md, line 49
- ADR (rule 6): lands in pd's `skills/parallel-development/references/design-decisions.md` - the workspace's SINGLE ADR log (csr-originated ADRs #52/#61/#62 already live there; csr
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
skills/cross-source-review/infra/scripts/hetero_doc_review.py, line 108
<project>/.env (shell wins). The wrapper reads it, INJECTS it as
skills/cross-source-review/infra/scripts/hetero_doc_review.py, line 328
<cwd>/.env.solidforge (the host workspace's arm-env IF present - the solidforge arm
skills/cross-source-review/infra/scripts/hetero_doc_review.py, line 329
convention; absent + silently skipped in external projects) THEN <cwd>/.env (generic).
Show more
skills/cross-source-review/infra/scripts/hetero_doc_review.py, line 334
_load_dotenv_file(os.path.join(root, ".env.solidforge"))
skills/cross-source-review/infra/scripts/hetero_doc_review.py, line 335
_load_dotenv_file(os.path.join(root, ".env"))
skills/cross-source-review/infra/scripts/hetero_doc_review.py, line 405
"from $CLAUDE_PROJECT_DIR or <cwd>/.env.solidforge then <cwd>/.env (shell wins) - "
skills/cross-source-review/infra/scripts/hetero_doc_review.py, line 406
"if you cd'd into the skill dir, re-run from the PROJECT ROOT (where .env.solidforge "
skills/cross-source-review/infra/scripts/hetero_doc_review.py, line 1266
# Previously this ran AFTER parse_args, so an env var set ONLY in .env (not the
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read. the file cap was reached before every file was read.
OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED
skills/parallel-development/references/design-decisions.md, line 1
# Design Decisions (ADR)
skills/primary-source-verification/infra/test/findings_shape_check.py, line 1
#!/usr/bin/env python3
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit ac7b34d8c456. can delete files. accepts a host from input, with no fixed list in this file. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.
Date and source
Date checked:
github.com
Commit graded: ac7b34d8c456671c024b83b5b4afbcf9add496cc
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.