Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 1 to 50 of 3,335 Grade C entries. Page 1 of 67.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.github/workflows/android.yml:62 curl -fsSL "https://get.maestro.mobile.dev" | bashFantasyPremierLeague (MCP server)
Compatibility: Not stated.
Fantasy Premier League Kotlin/Compose Multiplatform sample
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
assets/public/fonts/fa-brands-400.svg:1 <?xml version="1.0" standalone="no"?>mcp (Plugin)
Compatibility: Not stated.
Official VidGuy MCP connection configs for Gemini CLI, Cursor, and other AI assistants
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
bin/cli.js:138 fs.rmSync(oldInstall, { recursive: true, force: true });10X Code Context (Plugin)
Compatibility: Not stated.
Context Engineering Middleware for Claude Code , intelligent codebase indexing, token-efficient file selection, and session persistence via local MD files
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +1 more
runtime/host.py:173 proc = subprocess.run(cmd, cwd=str(root), env={**os.environ, **(extra_env or {})}, capture10xProductivity (Skill)
Compatibility: Not stated.
Personal AI assistant for work inside corporate constraints, built on coding agents and the tools, sessions, and permissions you already have.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:13 prepare12306 Mcp (MCP server)
Compatibility: Not stated.
This is a 12306 ticket search server based on the Model Context Protocol (MCP).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
skills/3080-brief/scripts/check_dependencies.py:59 result = subprocess.run(argv, text=True, capture_output=Tru3080 Brief (Skill)
Compatibility: Not stated.
**30-second judgment, 80% in one picture**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:17 prepare530A Model calculator (MCP server)
Compatibility: Not stated.
Free, deterministic 530A (Trump Account) projections, verified rules, and searchable guides.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES INSTALL_UNPINNED +3 more
adapters/shared/a_stock_data_upstream_smoke.py:26 subprocess.run(["git", "init", "--quiet", str(checkout)], chA Share Mainline Os (Skill)
Compatibility: Not stated.
[English](README_EN.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
src/abfall_mcp_server/geo.py:259 resp = requests.get(Abfallkalender Deutschland (MCP server)
Compatibility: Not stated.
*English · [Deutsch](README.de.md)*
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
scripts/markdown_gate_check.py:99 result = subprocess.run(command, check=False)Acdd Workflow (Skill)
Compatibility: Not stated.
ACDD means **Agentic Contract-Driven Development**.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
lib/action_mcp/prompt.rb:200 @response.add_content(content, role: args.fetch(:role, "user")) # Add to the respaction_mcp (MCP server)
Compatibility: Not stated.
**ActionMCP** is a Ruby gem focused on providing Model Context Protocol (MCP) capability to Ruby on Rails applications, specifically as a server.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skills/actionista/references/patterns-environments.md:299 curl -X PUT \actionista (Plugin)
Compatibility: Not stated.
GitHub Actions assistant - helps create, review, and optimize workflows with up-to-date action versions and best practices
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zIcej2NM0" style="display:none">mup2+/kIPno/jTzaHuuwQkEtShILq4grM7unMKJi5v2s93rx+xh5AGbAAd Ops Mcp Hub (Plugin)
Compatibility: Not stated.
**Manage Google Ads, Meta Ads, GA4, TikTok Ads, and LinkedIn Ads from a single AI conversation , with human-in-the-loop safety on every write operation.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV +1 more
packages/core/src/generation/llm-client.ts:133 const response = await fetch("https://api.anthropic.com/v1/messAdaptive Cards Mcp (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="media/hero.png" alt="adaptive-cards-mcp , 9 tools, 21 patterns, 924 tests, 0 competitors" width="800"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
plugins/adaptive-codex-orchestrator/scripts/validate_release_artifact.py:163 ".npmrc",Adaptive Codex Orchestrator (Plugin)
Compatibility: Not stated.
Control when Codex delegates bounded tasks, with explicit scope, profiles, and safe parallel execution.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
scripts/fetch-openapi.mjs:21 const res = await fetch(SPEC_URL, {AdButler (MCP server)
Compatibility: Not stated.
Manage AdButler campaigns, zones, ad items, VAST, and reports from Claude, ChatGPT, and Cursor.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
scripts/plugins/sync_skill.py:272 with urllib.request.urlopen(source, timeout=30) as response:adloop (MCP server)
Compatibility: Not stated.
<!-- mcp-name: com.getadloop/adloop -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
src/admin_procedures/cli.py:277 def fetch(dataset_id: str, data_dir: Path | None, allowed_hosts: tuple[str, ..Administrative Procedures Mcp (MCP server)
Compatibility: Not stated.
日本語 | [English](README.en.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
.agents/skills/repo-skill-creator/scripts/test_init_skill.py:17 result = subprocess.run(Adonis Skills (Skill)
Compatibility: Not stated.
English | [中文](./README.zh-CN.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
papers/commensurability/verifica_multi_reale.py:8 out=subprocess.run([sys.executable,"verifica_esempio_reale.pAdversarial Audit Engine (Plugin)
Compatibility: Not stated.
> Audits a document or technical artifact by trying to **falsify** it: blind adversarial review across > **different model vendors**, a deterministic grounding gate that blocks any finding not backed by a > verbatim quote, explicit control of the falsifier's own **Type-I error**,
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +2 more
aegis/mcp_server.py:87 def _kill_tree(proc: subprocess.Popen) -> None:Aegis Integrity (Plugin)
Compatibility: Not stated.
Free, local-first academic integrity checker and MCP server: citation hallucination detection, AI-text and plagiarism signals, venue guideline checks (IEEE, ACM, Elsevier).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/aena/client.ts:115 const res = await fetch(url);AENA Flights MCP (MCP server)
Compatibility: Not stated.
**Español: [README.es.md](README.es.md)**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:11 postinstallAfter Effects Mcp (MCP server)
Compatibility: Not stated.
MCP Server for Adobe After Effects.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/redmine-up.sh:40 until curl -sf -o /dev/null "${BASE_URL}/"; doAgama Redmine Mcp (MCP server)
Compatibility: Not stated.
[MCP server](https://modelcontextprotocol.io/) for Redmine.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
dashboard/app.js:35 const res = await fetch(API + path, {Agent Board (MCP server)
Compatibility: Not stated.
<p align="center"> <h1 align="center">🎯 Agent Board</h1> <p align="center"> <strong>Multi-agent task orchestration for <a href="https://github.com/openclaw/openclaw">OpenClaw</a> and AI agent teams.</strong><br/> Kanban dashboard · REST API · MCP server · DAG dependencies · Auto-
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
integrations/invoice_guard/test_crypto_contract.py:156 mock.patch("subprocess.run", side_effect=AssertionErrorAgent Decision & Evidence Tools (MCP + x402) (MCP server)
Compatibility: Not stated.
**40 machine-callable tools, including 10 free preparation, routing and verification tools.** Pay only for a successfully delivered result in USDC through x402.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +1 more
data/failure_corpus.jsonl:35 {"id": "162", "kind": "adr", "title": "ADR-162: T9OS Machine Awareness + IPC remoAgent Failure Archive (MCP server)
Compatibility: Not stated.
**186 post-mortems from running a multi-session AI agent system in production for 8 months.** Pay per call with [x402](https://x402.org).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skills/git-github-workflow/SKILL.md:122 - Do not commit secrets, `.env`, `id_rsa`, `*.pem`, or personal filesyAgent Guidance Kit (Skill)
Compatibility: Not stated.
Agent Guidance Kit is a portable collection of software-engineering agent skills that you can review, copy, and adapt into a compatible coding-agent environment.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
docs/legacy_scripts/parallax_prompt_workflow/workspace.py:163 result = subprocess.run(Agent Kaizen (Skill)
Compatibility: Not stated.
<p align="center"> <img src="docs/images/README.png" alt="Agent Kaizen - systems and tooling for improving AI coding-agent work in VS Code" width="900"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
bench/promote-bench.ts:245 if (backup.cursorExisted) fs.unlinkSync(cursorFile);Agent Knowledge (MCP server)
Compatibility: Not stated.
Cross-session memory for AI coding agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
loops/blue-team/tools/verify.py:48 proc = subprocess.run(Agent Loop Skills (Skill)
Compatibility: Not stated.
Drop-in agentic loop skills , autoresearch, literature & scientific writing, data analysis, code/SQL/prompt optimization, red-teaming, and power analysis.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
plugins/agent-orchestrator/scripts/cli_agent_job.py:832 subprocess.run(Agent Orchestrator (Plugin)
Compatibility: Not stated.
Codex plugin for orchestrating local coding-agent CLIs with task contracts, questions, observability, and review gates
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
agent_peer/agy_live.py:34 raw = subprocess.run(Agent Peer (Skill)
Compatibility: Not stated.
<p align="center"> <img src="https://raw.githubusercontent.com/mkhuda/agent-peer/main/assets/agent-peer-overview.webp" alt="agent-peer is a local IPC mesh for coding agents with four capabilities: direct messages, shared threads, live views, and a Telegram bridge.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
plugins/agentic-engineering/scripts/forge-readonly-guard.test.sh:487 expect_deny 'curl' "curl https://example.Agent Plugins (Plugin)
Compatibility: Not stated.
A plugin marketplace: ready-to-install bundles that teach your AI coding assistant new skills, connect it to tools, and give it specialist roles.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
scripts/verify-dist.sh:74 located = subprocess.run(Agent Plugins (Skill)
Compatibility: Not stated.
Ship Agent Plugins with Python packages and inspect their installed files.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
coolify-remote/skills/coolify-remote/SKILL.md:123 coolify-remote app exec hermes -- sh -c 'curl -sf http://locAgent Plus Skills (Plugin)
Compatibility: Not stated.
osouthgate's marketplace of [agent-plus](https://github.com/osouthgate/agent-plus) service wrappers , Claude Code plugins that collapse slow, multi-step API dances into one fast call across deploys, databases, cloud, billing, and logs.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:51 prepareAgent Profiler (Skill)
Compatibility: Not stated.
<h1 align="center">agent-profiler</h1> <p align="center"> <a href="https://www.npmjs.com/package/@ghostship/agent-profiler"><img src="https://img.shields.io/npm/v/@ghostship/agent-profiler.svg?logo=npm&label=npm&color=cb3837" alt="npm version" /></a> <a href="https://www.npmjs.co
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
docs/RULES.md:21 | `SHELL001` | error | Shell evaluation such as `shell=True`, `os.system`, or `Invoke-ExpressAgent Skill Release Kit (Plugin)
Compatibility: Not stated.
**Turn a private Agent Skill into a separate, reviewable release copy, without touching the source.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
skills/api-design-patterns/AGENTS.md:2712 const response = await fetch('/api/orders', {Agent Skills (Skill)
Compatibility: Not stated.
A collection of skills for AI coding agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV +1 more
skills/audio-loop/SKILL.md:105 bufferPromise = fetch(AUDIO_URL)Agent Skills (Skill)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
clawdbot/clawdbot-release-check/scripts/check.sh:86 releases_json=$(curl -sS "$RELEASES_URL" 2>/dev/null)Agent Skills (Skill)
Compatibility: Not stated.
A collection of AI agent skills for Clawdbot, Claude Code, Codex
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
skills/ax-audit/rules-arch/comm-no-approval-gate.md:94 const cleanupTool = { execute: (args) => fs.rm(args.temAgent Skills (Skill)
Compatibility: Not stated.
Skills for the parts of shipping that code review never covers: the loading states, the type scale, and whether half the diff is AI slop.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL
pulumi/skills/provider-upgrade/references/diagnostic-toolbox.md:45 curl -fsSL "https://github.com/pulumi/schemAgent Skills (Skill)
Compatibility: Not stated.
Teach your agent Pulumi: infrastructure as code in TypeScript, Python, Go, C#, Java, YAML, or HCL.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
tutorials/beginner-guides.md:234 result = subprocess.run(Agent Skills Collections (Skill)
Compatibility: Not stated.
一个精心整理的 AI Agent 技能资源集合。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +2 more
plugins/trelio-agent-workspaces/scripts/trelio-host-runtime-loader.mjs:259 await fs.rm(targetDirectory, { recuAgent Workspaces (Plugin)
Compatibility: Not stated.
Официальный плагин Trelio для работы Codex, Claude и Cursor Desktop с управляемыми Agent Workspaces и актуальными навыками компании и проектов.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
internal/mcpproxy/process.go:71 cmd := exec.Command(command, args...)AgentAnycast (MCP server)
Compatibility: Not stated.
**The core daemon powering AgentAnycast's P2P agent network.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:33 prepareAgentDS (Skill)
Compatibility: Not stated.
> Source-verified official design systems for coding agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
package.json:21 prepareagentflow (Skill)
Compatibility: Not stated.
An opinionated workflow for shipping production-ready changes with coding agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
plugins/agentgram/src/agentgram_tg/cli.py:1769 proc = subprocess.run(agentgram (Plugin)
Compatibility: Not stated.
Codex and AI-agent Telegram messaging plugin with a local CLI.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
requirements.txt:23 openaiAgentic Ai Engineering (MCP server)
Compatibility: Not stated.
**Agentic AI Engineering** is a production-grade engineering resource for building modern agentic AI systems with LangChain, LangGraph, RAG, MCP, local models, and deployable Python services.
This grade is a hygiene screen, not proof of safety.
