Claude Code, Skill
Wepr Growth Skills
Wepr Growth Skills, a skill listed in the PlugVet directory.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
NETWORK_HOST_FROM_INPUT
Why this grade
- NETWORK_HOST_FROM_INPUT Medium
A file takes a URL or endpoint as input and has no fixed host list.
skills/dbs-video-extract/scripts/extract_video_transcript.py, line 158
with urllib.request.urlopen(request, timeout=30) as response:
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
skills/dbs-skill-maker/scripts/validate_skill_project.py, line 182
result = subprocess.run(
skills/dbs-video-extract/scripts/extract_video_transcript.py, line 115
result = subprocess.run(
skills/dbs-video-extract/scripts/tikhub_api.py, line 127
result = subprocess.run(
Show more
skills/wepr-chatgpt-crawler/scripts/chatgpt_batch_crawl.mjs, line 463
fs.rmSync(logPath, { force: true });
skills/wepr-chatgpt-crawler/scripts/test_chatgpt_batch_delay.mjs, line 101
fs.rmSync(root, { recursive: true, force: true });
skills/wepr-deepseek-crawler/scripts/deepseek_batch_crawl.mjs, line 355
fs.rmSync(logPath, { force: true });
skills/wepr-deepseek-crawler/scripts/setup_deepseek_bridge.mjs, line 156
fs.rmSync(targetPath, { force: true });
skills/wepr-deepseek-crawler/scripts/setup_deepseek_bridge.mjs, line 205
fs.rmSync(targetDir, { recursive: true, force: true });
skills/wepr-deepseek-crawler/scripts/test_geo_deepseek_browser_direct.mjs, line 17
fs.rmSync(tempDir, { recursive: true, force: true });
skills/wepr-doubao-crawler/scripts/doubao_batch_crawl.mjs, line 365
fs.rmSync(logPath, { force: true });
skills/wepr-doubao-crawler/scripts/doubao_mobile_crawl.py, line 1035
result = subprocess.run(
skills/wepr-doubao-crawler/scripts/test_mobile_extraction.py, line 263
subprocess.run(
skills/wepr-geo-intent-miner/scripts/check_report_layout.py, line 52
info = subprocess.check_output(["pdfinfo", str(path)], text=True)
skills/wepr-geo-intent-miner/scripts/render_intent_miner_report.py, line 476
subprocess.check_call(
skills/wepr-geo-intent-miner/scripts/render_intent_miner_report.py, line 517
info = subprocess.check_output([pdfinfo, str(path)], text=True)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Serious
accepts a host from input, with no fixed list in this file.
NETWORK_HOST_FROM_INPUT
skills/dbs-video-extract/scripts/extract_video_transcript.py, line 158
with urllib.request.urlopen(request, timeout=30) as response:
skills/dbs-video-extract/scripts/tikhub_api.py, line 206
with urllib.request.urlopen(request, timeout=max(1.0, timeout)) as response:
skills/dbs-video-extract/scripts/tikhub_api.py, line 289
with urllib.request.urlopen(request, timeout=max(1.0, timeout)) as response:
Show more
skills/dbs-video-extract/scripts/tikhub_api.py, line 426
with urllib.request.urlopen(request, timeout=max(1.0, timeout)) as response:
skills/wepr-deepseek-crawler/scripts/setup_deepseek_bridge.mjs, line 121
const response = await fetch(url, {
skills/wepr-deepseek-crawler/scripts/setup_deepseek_bridge.mjs, line 135
const response = await fetch(url, {
skills/wepr-deepseek-crawler/scripts/setup_deepseek_bridge.mjs, line 153
console.log(`curl download failed (${message}); trying gh release download...`);
skills/wepr-doubao-crawler/scripts/doubao_mobile_crawl.py, line 1072
with urllib.request.urlopen(url, timeout=timeout) as response:
skills/wepr-geo-brand-graph/scripts/collect_source_validation.py, line 67
with urllib.request.urlopen(request, timeout=timeout) as response:
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
skills/dbs-video-extract/scripts/extract_video_transcript.py, line 90
value = os.environ.get("QINGDOU_API_KEY", "").strip()
skills/dbs-video-extract/scripts/extract_video_transcript.py, line 93
configured_path = os.environ.get("QINGDOU_API_KEYS_FILE", "").strip()
skills/dbs-video-extract/scripts/extract_video_transcript.py, line 112
and os.environ.get("DBS_VIDEO_EXTRACT_DISABLE_KEYCHAIN") != "1"
Show more
skills/dbs-video-extract/scripts/tikhub_api.py, line 112
value = os.environ.get("TIKHUB_API_KEY", "").strip()
skills/dbs-video-extract/scripts/tikhub_api.py, line 116
configured_path = os.environ.get("TIKHUB_API_KEYS_FILE", "").strip()
skills/dbs-video-extract/scripts/tikhub_api.py, line 124
and os.environ.get("DBS_VIDEO_EXTRACT_DISABLE_KEYCHAIN") != "1"
skills/operate-georank-workbench/scripts/georank_client.py, line 391
token = os.environ.get("GEORANK_TOKEN") or session.get("access_token")
skills/operate-georank-workbench/scripts/georank_client.py, line 450
"environment_token_present": bool(os.environ.get("GEORANK_TOKEN")),
skills/dbs-knowledge/SKILL.md, line 105
- `.env`、密钥文件、密码文件、凭证数据库
skills/dbs-learning/SKILL.md, line 131
4. 默认跳过 `.git/`、`.env`、`.private/`、密钥、密码、凭证、身份信息、财务原件、客户私密资料和其他明确标记为敏感的内容。
skills/dbs-learning/SKILL.md, line 448
项目中同时存在相关公开内容、`.env`、API 密钥、客户私密资料和财务原件。
skills/wepr-geoflow/SKILL.md, line 51
- 升级 3.0.0 前必须备份数据库、`.env`、上传目录和 `storage`，排空旧进程，核验迁移、前端构建、队列、调度器、实时服务及签名更新工具的兼容版本；不得只依据版本号直接执行升级。
skills/wepr-geoflow/evals/test_geoflow_scripts.py, line 848
for blocked in ("/.env", "/../SKILL.md", "/assets/../index.html", "/", "/unknown.json"):
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read. the file cap was reached before every file was read.
OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED
skills/wepr-chatgpt-crawler/scripts/analyze_chatgpt_results.py, line 1
#!/usr/bin/env python3
skills/wepr-deepseek-crawler/scripts/analyze_deepseek_results.py, line 1
#!/usr/bin/env python3
skills/wepr-doubao-crawler/scripts/analyze_doubao_results.py, line 1
#!/usr/bin/env python3
Show more
skills/wepr-geo-explainer-builder/SKILL.md, line 1
---
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 822504b8c720. can delete files. accepts a host from input, with no fixed list in this file. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.
Date and source
Date checked:
github.com
Commit graded: 822504b8c72003b7efe84cb5c621bf752a3244fe
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.