Grades are a hygiene check, not a security guarantee.

Codex, Plugin

Stackcord

Question-driven full-stack collaboration harness for Codex with durable context, Git/submodule coordination, semantic conflict checks, and release continuity.

Compatibility: Not stated.

Grade C

One Medium finding. Read the findings before installing.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

Rescanned at commit 3e557438455b, unchanged since the check below.

OBFUSCATION_MINIFIED_PAYLOAD

Why this grade

  • OBFUSCATION_MINIFIED_PAYLOAD Medium

    Contains a very long line with almost no spaces in a script or style file.

    cli/internal/dashboard/assets/app.js, line 51 function list(items, empty='none') {const box=el('div');if(!Array.isArray(items)||!items.length){box.append(el('div','empty',t(empty)));return box;}items.forEach(item=>{if(!item||t

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Concern

    can delete files.

    PERMISSION_DELETE_FILES

    cli/internal/channel/channel.go, line 374

    cmd := exec.CommandContext(ctx, "git", append(base, args...)...)

    cli/internal/channel/channel_test.go, line 21

    if out, e := exec.Command("git", "init", "--bare", remote).CombinedOutput(); e != nil {

    cli/internal/channel/channel_test.go, line 165

    child := exec.Command(exe, "-test.run=TestDetachedDescendantHelper", filepath.Join(os.Args[2], "descendant-marker"))

    Show more

    cli/internal/channel/channel_test.go, line 415

    cmd := exec.Command("git", append([]string{"-C", a.root}, args...)...)

    cli/internal/channel/code_execution.go, line 39

    cmd := exec.CommandContext(ctx, "git", append(options, args...)...)

    cli/internal/channel/code_execution.go, line 160

    cmd := exec.CommandContext(verifyCtx, p.VerifyArgv[0], p.VerifyArgv[1:]...)

    cli/internal/channel/code_execution_test.go, line 106

    cmd := exec.Command("git", append([]string{"-C", root}, args...)...)

    cli/internal/channel/lock_windows.go, line 33

    out, e := exec.Command("icacls", p, "/inheritance:r", "/grant:r", "*"+u.Uid+":(OI)(CI)F").CombinedOutput()

    profiles/strict-release/scripts/generate_packages.py, line 37

    shutil.rmtree(output)

  • Install and update

    Pass

    No install-time script found, and dependencies are pinned or absent.

  • Network

    Concern

    can reach a host that is not written as a fixed address.

    NETWORK_NO_FIXED_HOST

    cli/internal/dashboard/assets/app.js, line 93

    'sessionMissing'));const response=await fetch('/api/'+path,{method:body?'POST':'GET',c

    scripts/bootstrap-cli.sh, line 73

    command -v curl >/dev/null 2>&1 || { printf 'curl is required.\n' >&2; exit 3; }

    scripts/bootstrap-cli.sh, line 74

    curl --proto '=https,http' --proto-redir '=https,http' --tlsv1.2 -fsSL "${RELEASE_URL}/checksums.txt" -o "$CHECKSUMS"

    Show more

    scripts/bootstrap-cli.sh, line 75

    curl --proto '=https,http' --proto-redir '=https,http' --tlsv1.2 -fsSL "${RELEASE_URL}/${ASSET}" -o "$DOWNLOAD"

  • Secrets

    Concern

    reads a credential or environment file.

    SECRETS_PATH_DOTENV

    cli/internal/project/generate.go, line 26

    ".gitignore": ".harness/local/\n.harness-drafts/\n.env\n.env.*\n!.env.example\n*.log\n",

    scripts/security_scan.py, line 26

    if path.name == ".env" or (path.name.startswith(".env.") and path.name != ".env.example"):

    .gitignore, line 10

    *.log

    Show more

    .gitignore, line 11

    .env

    .gitignore, line 13

    !.env.example

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Concern

    contains a minified payload.

    OBFUSCATION_MINIFIED_PAYLOAD

    cli/internal/dashboard/assets/app.js, line 51

    function list(items, empty='none') {const box=el('div');if(!Array.isArray(items)||!items.length){box.append(el('div','empty',t(empty)));return box;}items.forEach(item=>{if(!item||t

    cli/internal/dashboard/assets/app.js, line 52

    function overview(view) {view.append(heading('overviewTitle','overviewSub'));const stats=el('div','stats');[['security',state?.settings?.securityMode,'trustedPolicy'],['openIssues'

    cli/internal/dashboard/assets/app.js, line 53

    function field(form,name,label,value,{type='text',wide=false,help,options,required=false}={}) {const wrap=el('div',`field${wide?' wide':''}`),id=`field-${name}`,lab=el('label','',t

    Show more

    cli/internal/dashboard/assets/app.js, line 57

    function delegateRow(value={}){const row=el('div','delegate-row'),sequence=++delegateSequence;row.dataset.original=JSON.stringify(value);const fields=el('div','form-grid');field(fi

    cli/internal/dashboard/assets/app.js, line 59

    function readDelegates(editor){return [...editor.querySelectorAll('.delegate-row')].map(row=>{const original=JSON.parse(row.dataset.original||'{}'),f=new FormData();row.querySelect

    cli/internal/dashboard/assets/app.js, line 60

    function settings(view) {view.append(heading('settingsTitle','settingsSub'));const revision=state?.revision,s=state?.settings||{},form=el('form');const first=el('div','panel-body f

    cli/internal/dashboard/assets/app.js, line 91

    function issues(view) {const revision=state?.revision;view.append(heading('issuesTitle','issuesSub'));const grid=el('div','grid-two');grid.append(panel('issuesList',list(state?.iss

    cli/internal/dashboard/assets/app.js, line 92

    function render() {translateShell();nav();$('project-name').textContent=state?.project?.name||'Stackcord';$('project-branch').textContent=state?.project?.branch||state?.settings?.t

  • Licence

    Pass

    A licence file is present (LICENSE).

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 3e557438455b. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. contains a minified payload.

Date and source

Date checked:

View source

github.com

Commit graded: 3e557438455b92e29bdbd54b0a07bd028bde4877

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen