Grades are a hygiene check, not a security guarantee.

Claude Code, Skill

Ui Sift

设计、实现、评审或打磨简洁且交互精致的前端页面与组件。提供项目画像、视觉判断、精选组件检索、官方 skills/MCP 与源码发现、多库集成和证据验收。适用于新页面、后台、AI 对话、文档工作台、参考还原和局部 UI 改善；纯后端、仅修复业务逻辑或机械改字时不使用。

Compatibility: Not stated.

Grade C

One Medium finding. Read the report before installing.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

NETWORK_HOST_FROM_INPUT

Why this grade

  • NETWORK_HOST_FROM_INPUT Medium

    A file takes a URL or endpoint as input and has no fixed host list.

    scripts/fetch_reference.py, line 63 def fetch(source, url, kind, output, max_bytes=2_000_000, timeout=15):

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Pass

    No shell or command execution found, and no extra permission was declared.

  • Install and update

    Pass

    No install-time script found, and dependencies are pinned or absent.

  • Network

    Serious

    accepts a host from input, with no fixed list in this file.

    NETWORK_HOST_FROM_INPUT

    scripts/fetch_reference.py, line 63

    def fetch(source, url, kind, output, max_bytes=2_000_000, timeout=15):

    scripts/fetch_reference.py, line 102

    result = fetch(args.source, args.url, args.kind, args.out)

    .github/scripts/update_install_badge.py, line 41

    with urllib.request.urlopen(request, timeout=30) as response:

  • Secrets

    Concern

    reads a credential or environment file.

    SECRETS_PATH_DOTENV

    .gitignore, line 6

    dist/

    .gitignore, line 7

    .env

    references/tooling.md, line 15

    只读，不联网，不执行项目脚本。跳过隐藏文件、隐藏目录、符号链接、node_modules 和常见产物目录；不读取 `.env`、锁文件内容或脚本命令字符串。registry 只输出名称，不输出带鉴权参数的地址。依赖中的 URL 引用不会原样输出。

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Pass

    No encoded or minified payload found.

  • Licence

    Pass

    A licence file is present (LICENSE).

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 4ab67410a2fc. accepts a host from input, with no fixed list in this file. reads a credential or environment file.

Date and source

Date checked:

View source

github.com

Commit graded: 4ab67410a2fcdb25b9c5119a92beb1741f34cd31

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen