Cursor, Plugin
Skill Packager Skill
Package AI agent skills into deployment formats — .zip, .skill, Claude plugin, Claude marketplace, Cursor plugin, Cursor marketplace, native Codex/ChatGPT plugin, ChatGPT/Manus zip, Codex CLI, NanoClaw marketplace, OpenClaw/ClawHub, Agent Skills standard (.agents/), or a univers
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit ca4750e2ba9d, unchanged since the check below.
NETWORK_HOST_FROM_INPUT
Why this grade
- NETWORK_HOST_FROM_INPUT Medium
A file takes a URL or endpoint as input and has no fixed host list.
skill-packager-workspace/iteration-1/eval-1-universal-repo/without_skill/outputs/proof-engine-skill/skill/scripts/fetch.py, line 58
resp = requests.get(wayback_url, timeout=timeout,
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
If you think this grade is wrong, email [email protected] with the entry link and your evidence. We aim to acknowledge within two working days and decide within seven. If we confirm an error, we aim to correct it within 24 hours of confirming it. These are aims, not guarantees.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
.agents/skills/skill-packager/scripts/skill_packager/metadata.py, line 163
result = subprocess.run(
.agents/skills/skill-packager/scripts/skill_packager/metadata.py, line 179
result = subprocess.run(
.agents/skills/skill-packager/scripts/skill_packager/templates.py, line 745
shutil.rmtree(tmpdir, ignore_errors=True)
Show more
skill-packager/skills/skill-packager/scripts/skill_packager/metadata.py, line 163
result = subprocess.run(
skill-packager/skills/skill-packager/scripts/skill_packager/metadata.py, line 179
result = subprocess.run(
skill-packager/skills/skill-packager/scripts/skill_packager/templates.py, line 745
shutil.rmtree(tmpdir, ignore_errors=True)
skill-packager-workspace/iteration-1/eval-1-universal-repo/with_skill/outputs/copy_remaining.py, line 51
shutil.rmtree(pycache)
tools/build-zip.py, line 227
shutil.rmtree(tmpdir, ignore_errors=True)
tools/sync-agents-mirror.py, line 24
shutil.rmtree(DST)
tools/sync-github-about.py, line 41
current = subprocess.run(
tools/sync-github-about.py, line 56
r = subprocess.run(["gh", "repo", "edit", repo, "--description", about],
docs/superpowers/plans/2026-04-07-skill-packager-scripts.md, line 65
result = subprocess.run(
docs/superpowers/plans/2026-04-07-skill-packager-scripts.md, line 74
result = subprocess.run(
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Serious
accepts a host from input, with no fixed list in this file.
NETWORK_HOST_FROM_INPUT
skill-packager-workspace/iteration-1/eval-1-universal-repo/without_skill/outputs/proof-engine-skill/skill/scripts/fetch.py, line 58
resp = requests.get(wayback_url, timeout=timeout,
skill-packager-workspace/iteration-1/eval-1-universal-repo/without_skill/outputs/proof-engine-skill/skill/scripts/fetch.py, line 81
skip_live_fetch: If True, skip live HTTP fetch (e.g., when requests
skill-packager-workspace/iteration-1/eval-1-universal-repo/without_skill/outputs/proof-engine-skill/skill/scripts/fetch.py, line 94
resp = requests.get(
Show more
skill-packager-workspace/iteration-1/eval-1-universal-repo/without_skill/outputs/proof-engine-skill/skill/scripts/smart_extract.py, line 403
resp = requests.get(args.url, timeout=15, headers={"User-Agent": "proof-engine/1.0"})
skill-packager-workspace/iteration-1/eval-1-universal-repo/without_skill/outputs/proof-engine-skill/skill/scripts/verify_citations.py, line 16
- Live fetch (default): fetches the URL and verifies against the response
skill-packager-workspace/iteration-1/eval-1-universal-repo/without_skill/outputs/proof-engine-skill/skill/scripts/verify_citations.py, line 602
resp = requests.get(
skill-packager-workspace/iteration-1/eval-1-universal-repo/with_skill/outputs/proof-engine-skill/proof-engine/skills/proof-engine/SKILL.md, line 34
- **WebFetch/WebSearch return summaries, not verbatim text** - Never use text from WebFetch/WebSearch directly as the `quote` field in `empirical_facts`. Use these tools to identif
skill-packager-workspace/iteration-1/eval-1-universal-repo/with_skill/outputs/proof-engine-skill/proof-engine/skills/proof-engine/references/environment-and-sources.md, line 72
- (a) Python `requests.get()` in proof.py (this is what `verify_all_citations` will use anyway)
skill-packager-workspace/iteration-1/eval-1-universal-repo/with_skill/outputs/proof-engine-skill/proof-engine/skills/proof-engine/references/hardening-rules.md, line 147
**How validate_proof.py catches it**: Looks for imports of `verify_citations` / `verify_all_citations`, or presence of `requests.get`.
skill-packager-workspace/iteration-1/eval-1-universal-repo/with_skill/outputs/proof-engine-skill/proof-engine/skills/proof-engine/scripts/fetch.py, line 58
resp = requests.get(wayback_url, timeout=timeout,
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
VERSIONING.md, line 52
cowork-harness --dotenv <path>/.env record "harness/scenarios/$n.yaml" \
harness/README.md, line 39
cowork-harness --dotenv <path>/.env run harness/scenarios/script-invocation.yaml
harness/README.md, line 40
cowork-harness --dotenv <path>/.env run harness/scenarios/no-trigger.yaml
Show more
harness/README.md, line 45
injects only env / `.env`; a token in the macOS Keychain is not passed through, so
harness/README.md, line 77
cowork-harness --dotenv <path>/.env record harness/scenarios/<name>.yaml \
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains an encoded blob in a file that should be readable.
OBFUSCATION_ENCODED_BLOB
harness/cassettes/script-invocation.cassette.json, line 56
"{\"type\":\"assistant\",\"message\":{\"model\":\"claude-sonnet-5\",\"id\":\"msg_011CeXYRqqQnWK35LBzt456e\",\"type\":\"message\",\"role\":\"assistant\",\"content\":[{\"type\":\"thi
harness/cassettes/script-invocation.cassette.json, line 63
"{\"type\":\"assistant\",\"message\":{\"model\":\"claude-sonnet-5\",\"id\":\"msg_011CeXYS1XKWqZFSBN4yRGTY\",\"type\":\"message\",\"role\":\"assistant\",\"content\":[{\"type\":\"thi
harness/cassettes/script-invocation.cassette.json, line 70
"{\"type\":\"assistant\",\"message\":{\"model\":\"claude-sonnet-5\",\"id\":\"msg_011CeXYSMe3Ur6T5UHa5SBn6\",\"type\":\"message\",\"role\":\"assistant\",\"content\":[{\"type\":\"thi
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit ca4750e2ba9d. can delete files. accepts a host from input, with no fixed list in this file. reads a credential or environment file. contains an encoded blob in a file that should be readable.
Date and source
Date checked:
github.com
Commit graded: ca4750e2ba9d91a8d07e136c9d44cc5ae547dcc0
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.