Claude Code, Skill
Terminal Skills
Terminal Skills, a skill listed in the PlugVet directory.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 464c2954287a, unchanged since the check below.
SECRETS_PATH_CREDENTIAL
Why this grade
- SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
backup/rsync/SKILL.md, line 66
rsync -avz -e 'ssh -i ~/.ssh/key' source/ user@host:/path/
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach dr-site. The description does not name that host. can reach a host that is not written as a fixed address. can reach prometheus. The description does not name that host. can reach alertmanager. The description does not name that host. can reach container2. The description does not name that host. can reach service. The description does not name that host. can reach service-name. The description does not name that host. can reach ingress-ip. The description does not name that host. can
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
backup/disaster-recovery/SKILL.md, line 176
curl -s http://localhost/health
backup/disaster-recovery/SKILL.md, line 195
curl -s http://dr-site/health >> $LOG
database/elasticsearch/SKILL.md, line 19
curl -X GET "localhost:9200/_cluster/health?pretty"
Show more
database/elasticsearch/SKILL.md, line 22
curl -X GET "localhost:9200/_cluster/state?pretty"
database/elasticsearch/SKILL.md, line 25
curl -X GET "localhost:9200/_cluster/stats?pretty"
database/elasticsearch/SKILL.md, line 28
curl -X GET "localhost:9200/_nodes?pretty"
database/elasticsearch/SKILL.md, line 29
curl -X GET "localhost:9200/_nodes/stats?pretty"
database/elasticsearch/SKILL.md, line 32
curl -X GET "localhost:9200/_cat/shards?v"
database/elasticsearch/SKILL.md, line 33
curl -X GET "localhost:9200/_cat/allocation?v"
docker/dockerfile/SKILL.md, line 143
CMD curl -f http://localhost/ || exit 1
docker/dockerfile/SKILL.md, line 175
CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1
network/load-balancer/SKILL.md, line 334
curl http://localhost:8404/stats
network/load-balancer/SKILL.md, line 337
curl http://localhost/nginx_status
openclaw/configuration/SKILL.md, line 488
curl -X PUT http://localhost:8080/api/admin/config \
openclaw/configuration/SKILL.md, line 497
curl http://localhost:8080/api/admin/config \
openclaw/configuration/SKILL.md, line 501
curl -X POST http://localhost:8080/api/admin/config/refresh \
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
backup/rsync/SKILL.md, line 66
rsync -avz -e 'ssh -i ~/.ssh/key' source/ user@host:/path/
cloud-cli/aws-cli/SKILL.md, line 26
~/.aws/credentials
docker/compose/SKILL.md, line 148
- .env
Show more
docker/compose/SKILL.md, line 149
- .env.local
docker/compose/SKILL.md, line 239
# .env
docker/dockerfile/SKILL.md, line 291
.env
docker/dockerfile/SKILL.md, line 292
.env.*
kubernetes/configmap-secret/SKILL.md, line 124
kubectl create secret generic my-secret --from-file=ssh-privatekey=~/.ssh/id_rsa
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 464c2954287a. can reach dr-site. The description does not name that host. can reach a host that is not written as a fixed address. can reach prometheus. The description does not name that host. can reach alertmanager. The description does not name that host. can reach container2. The description does not name that host. can reach service. The description does not name that host. can reach service-name. The description does not name that host. can reach ingress-ip. The description does not name that host. can reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 464c2954287ad0c0b9addb1ebfbb2150ddc0de24
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.