Codex, Plugin
Kabo Plugins
Creator research skills for Claude Code and Codex: see what's working on YouTube, Instagram, and TikTok, review accounts and competitors, break down videos, and plan what to post, with the public evidence attached.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit fcd7ceb6c88e.
SECRETS_PATH_CREDENTIAL
Why this grade
- SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
plugins/claude/kabo-alpha/scripts/lib/common.js, line 6
// tab (any device works), and the token lands in <data root>/credentials.json with mode 0600.
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
plugins/claude/kabo-alpha/scripts/hooks/persist-envelope.js, line 513
fs.rmSync(`${stem}.lock`, { force: true });
plugins/claude/kabo-alpha/scripts/hooks/persist-envelope.js, line 520
fs.rmSync(`${stem}.lock`, { force: true });
plugins/claude/kabo-alpha/scripts/hooks/persist-envelope.js, line 528
fs.rmSync(`${stem}.lock`, { force: true });
Show more
plugins/claude/kabo-alpha/scripts/hooks/persist-envelope.js, line 593
fs.rmSync(`${stem}.lock`, { force: true });
plugins/claude/kabo-alpha/scripts/hooks/persist-envelope.js, line 600
fs.rmSync(`${stem}.lock`, { force: true });
plugins/claude/kabo-alpha/scripts/hooks/persist-envelope.js, line 608
fs.rmSync(`${stem}.lock`, { force: true });
plugins/claude/kabo-alpha/scripts/hooks/session-start.js, line 383
fs.rmSync(path.join(cacheRoot(), entry), { force: true });
plugins/claude/kabo-alpha/scripts/hooks/session-start.js, line 404
fs.rmSync(cacheDir, { recursive: true, force: true });
Install and update
Note
The docs document an installer that pipes a download into a shell.
INSTALL_DOCUMENTED_INSTALLER
README.md, line 106
curl -fsSL https://raw.githubusercontent.com/kabo-sh/kabo-plugins/main/install.sh | bash
README.md, line 141
curl -fsSL https://raw.githubusercontent.com/kabo-sh/kabo-plugins/main/install.sh | bash
README.md, line 149
curl -fsSL https://raw.githubusercontent.com/kabo-sh/kabo-plugins/main/install.sh | bash -s -- --dry-run
Show more
README.md, line 150
curl -fsSL https://raw.githubusercontent.com/kabo-sh/kabo-plugins/main/install.sh | bash -s -- --client claude,codex
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
plugins/claude/kabo-alpha/scripts/lib/common.js, line 894
const res = await fetch(url, {
plugins/claude/kabo-alpha/scripts/lib/credentials.js, line 83
const res = await fetch(url, {
plugins/claude/kabo-alpha/scripts/lib/credentials.js, line 101
const res = await fetch(url, {
Show more
plugins/claude/kabo-alpha/scripts/lib/credentials.js, line 137
const res = await fetch(`${endpoint}${AS_METADATA_PATH}`, { signal: AbortSignal.timeout(timeoutMs) });
plugins/codex/kabo-alpha/scripts/lib/common.js, line 537
const res = await fetch(url, {
plugins/claude/kabo-alpha/bin/kabo-headers, line 226
const response = await fetch(`${endpoint}/mcp-for-claude`, {
plugins/claude/kabo-alpha/bin/kabo-headers, line 247
const response = await fetch(`${endpoint}/mcp-for-claude`, {
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_CREDENTIAL
plugins/claude/kabo-alpha/scripts/lib/common.js, line 6
// tab (any device works), and the token lands in <data root>/credentials.json with mode 0600.
plugins/claude/kabo-alpha/scripts/lib/common.js, line 139
* credential, deliberately NOT a field inside credentials.json: the shims must never open that file.
plugins/claude/kabo-alpha/scripts/lib/common.js, line 386
/** File format version of credentials.json; a file that does not say 1 is treated as absent */
Show more
plugins/claude/kabo-alpha/scripts/lib/common.js, line 390
* The one credential file: <data root>/credentials.json.
plugins/claude/kabo-alpha/scripts/lib/common.js, line 399
return path.join(dataRoot(), 'credentials.json');
plugins/claude/kabo-alpha/scripts/lib/common.js, line 447
const tmp = path.join(dir, `credentials.json.tmp-${process.pid}`);
plugins/claude/kabo-alpha/scripts/lib/common.js, line 488
if (name.startsWith('credentials.json.tmp-')) fs.rmSync(path.join(dataRoot(), name), { force: true });
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read.
OBFUSCATION_FILE_OVER_READ_CAP
contracts-snapshot/creator-skills/host-fixtures/[email protected]/host-staging/0/01a13fde-64ff-7cb1-b341-65ff84741f77/01.json, line 1
{"schema_version":"trend-candidate-set.v1","status":"partial","platform":"instagram","window":"last-year","retrieved_at":"2026-10-15T14:03:13.384Z","discovery_window":{"since":"202
contracts-snapshot/creator-skills/host-fixtures/[email protected]/host-staging/0/01a13fd0-b5d6-7493-b99f-78705921a0cd/03.json, line 1
{"schema_version":"1.0","connector_id":"instagram-discovery","operation":"list_reels","provider":"Instagram discovery","status":"completed","summary":"Instagram discovery user-reel
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit fcd7ceb6c88e. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read.
Date and source
Date checked:
github.com
Commit graded: fcd7ceb6c88e180b20ae9ab3d639222581f5677d
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.