Grades are a hygiene check, not a security guarantee.

Codex, Plugin

Ecommerce Batch Studio

把商品参考图和真实资料，整理成按货号归档的图片、提示词与标题 Excel。

Compatibility: Not stated.

Grade B

Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

SECRETS_PATH_DOTENV PERMISSION_SHELL_DECLARED

Why this grade

  • SECRETS_PATH_DOTENV Low

    Mentions a .env file.

    plugins/ecommerce-batch-studio/src/providers.py, line 47 # Deliberately do not read arbitrary project .env files.

  • PERMISSION_SHELL_DECLARED Note

    Runs shell commands, and the manifest or description says so.

    plugins/ecommerce-batch-studio/scripts/setup.py, line 9 subprocess.run([str(runtime / 'bin/python'), '-m', 'pip', 'install', '-r', str(root / 'requirements.txt')], check=True)

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Note

    requests shell access. The manifest names this permission.

    PERMISSION_SHELL_DECLARED

    plugins/ecommerce-batch-studio/scripts/setup.py, line 9

    subprocess.run([str(runtime / 'bin/python'), '-m', 'pip', 'install', '-r', str(root / 'requirements.txt')], check=True)

  • Install and update

    Pass

    No install-time script found, and dependencies are pinned or absent.

  • Network

    Pass

    No network call found.

  • Secrets

    Concern

    reads a credential or environment file.

    SECRETS_PATH_DOTENV

    plugins/ecommerce-batch-studio/src/providers.py, line 47

    # Deliberately do not read arbitrary project .env files.

    .gitignore, line 1

    .DS_Store

    .gitignore, line 2

    .env

    Show more

    plugins/ecommerce-batch-studio/.gitignore, line 1

    .env

    plugins/ecommerce-batch-studio/docs/CANGYUAN_API.md, line 23

    配置文件：`~/.config/ecommerce-batch-studio/.env`。也可通过 `ECOM_ENV_FILE` 指定专用配置路径；进程环境变量优先。不要把密钥放入聊天、MCP 参数、批次 JSON 或仓库。

    plugins/ecommerce-batch-studio/docs/CANGYUAN_API.md, line 169

    此示例从进程环境读取；插件本身另支持上述专用 `.env` 文件。视频改为视频 Key 与 `POST /v1/videos`，JSON 使用对应视频模型、prompt 和该型号允许的字段。轮询成功后从 `data[0].url` 或视频的 `video_url` 取结果，用不带 Authorization 的独立客户端获取文件。

    plugins/ecommerce-batch-studio/docs/PROVIDERS.md, line 21

    内置生图的可用性及用量由当前宿主提供。不可用时暂停说明，不自动切换外部付费渠道。默认不需要 `.env`。

    plugins/ecommerce-batch-studio/docs/PROVIDERS.md, line 25

    本地专用配置位置为 `~/.config/ecommerce-batch-studio/.env`；可用 `ECOM_ENV_FILE` 指向用户指定文件。环境变量优先，不扫描其他项目、不复制历史密钥、不将密钥存入插件或批次。

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Pass

    No encoded or minified payload found.

  • Licence

    Note

    no licence file found.

    LICENCE_MISSING

    No file path was stored.

    no licence file found.

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit aa5331b6d57a. requests shell access. The manifest names this permission. reads a credential or environment file. no licence file found.

Date and source

Date checked:

View source

github.com

Commit graded: aa5331b6d57a37fdbfc25fce2d96cf738c3f3fee

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen