Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 451 to 500 of 3,335 Grade C entries. Page 10 of 67.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
skills/general/text-to-speech/references/streaming.md:40 process = subprocess.Popen(ElevenLabs (MCP server)
Compatibility: Not stated.
ElevenLabs voice AI , text-to-speech, voice agents, and speech engine skills, agent management via the ElevenLabs hosted MCP server, plus Architect skills for building and iterating on ElevenLabs agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
src/cache/blob-store.ts:74 await fs.rm(temp, { force: true });Email Mcp (MCP server)
Compatibility: Not stated.
An MCP (Model Context Protocol) server providing comprehensive email capabilities via IMAP and SMTP.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
README.md:21 This system treats profiles as **living configuration files**—version-controlled, modular, and hoEngineer By Example (Plugin)
Compatibility: Not stated.
**Version 2.4.1** | **MIT Licensed** | **Released 2026 Edition**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_MINIFIED_PAYLOAD
skills/impeccable/scripts/modern-screenshot.umd.js:7 tTimeout(()=>a.abort(),r):void 0;return fetch(t,D({signalEngineering Review Board (Skill)
Compatibility: Not stated.
This repository is the canonical local source for reusable, project-neutral agent skills.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
plugins/english-exam-coach/skills/english-exam-coach/scripts/speak.py:104 done = subprocess.run(command, stdouEnglish Exam Coach (Plugin)
Compatibility: Not stated.
Claude Code plugin for CEFR-aligned English exam prep: IELTS, TOEFL iBT (2026 format), CEFR B1-C2.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
scripts/fetch-longmemeval.sh:35 if command -v curl > /dev/null 2>&1; thenEngram Mcp (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/logo.svg" alt="Engram Logo" width="180" height="180"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
src/engrim/adapters/agy.py:65 subprocess.Popen(engrim (MCP server)
Compatibility: Not stated.
**The Universal Cross-Model & Cross-Agent Episodic Memory Standard.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
skills/enterprise-legal-ops/scripts/archive_record.py:405 proc = subprocess.run(cmd, text=True, stdout=subprocEnterprise Legal Ops (Skill)
Compatibility: Not stated.
中小企业本地法务运营管理 Skill。用于企业内部管理合同、员工/劳动合同/年假/制度、公章证照、章程权限、股东出资、提醒和本地自然语言问库。用户要初始化企业法务工作区、上传历史合同/员工花名册/劳动制度/证照/章程/授权/用印记录、生成本地台账、查询到期提醒、做企业内部合同审查 Word 修订稿、合同起草、HR 风险预判、制度冲突检查、旧制度合法性审查、公章用印权限校验、股东出资提醒、飞书日历提醒配置时触发。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
requirements.txt:1 mcp>=1.2.0Entscheidsuche Schweizer Gerichtsentscheide (MCP server)
Compatibility: Not stated.
Suche in Schweizer Gerichtsentscheiden aller Instanzen (Bund, Kantone) in DE/FR/IT.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:15 prepareErpnext Mcp Server (MCP server)
Compatibility: Not stated.
A Model Context Protocol server for ERPNext integration
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
packages/cli/src/Cli.ts:727 fs.unlinkSync(target)etemaro (Skill)
Compatibility: Not stated.
<p align="center"> <img src="assets/favicon.svg" alt="Etemaro Logo" width="100" height="100" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zZGV26Ph0" style="display:none">Ra+DJ9QSYQlBS1iI/JH1vWncpE5rG3bxFcB2yeH4m8lzso8t1gImcxgGEtsy Ugc Compliance Harvester (Plugin)
Compatibility: Not stated.
Etsy Seller Ops: The 2026 Open-Source Suite for Claude Code Automation & Compliance
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_UNCONFIRMED
evil_winrm_py/evil_winrm_py.py:249 text that Invoke-Expression and add_script() rely on.Evil Winrm Py (MCP server)
Compatibility: Not stated.
Execute commands interactively on remote Windows machines using the WinRM protocol (just faster)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
package.json:52 prepareexa (Plugin)
Compatibility: Not stated.
Exa AI web search, deep research, and content extraction.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
.github/actions/gate-estilo/comparar.py:47 return subprocess.run(Excalidraw Icons Mcp (MCP server)
Compatibility: Not stated.
A **faster** Excalidraw MCP server built around **real vendor icons**.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zklwhrCm0" style="display:none">s9FGldMBOytOsfrXEM4fbuHrXjNjjovc9qbc0bHUmhOFzEqf0RF8URf8Exo Harness Ai Pipeline (Plugin)
Compatibility: Not stated.
Claude Code AI Pipeline 2026 , PEV Framework Harness Plugin for Developers
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:15 prepareFabric Mcp Server (MCP server)
Compatibility: Not stated.
1.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:11 postinstallFacebook Ads Library Mcp (MCP server)
Compatibility: Not stated.
Public repository proxy-intell/facebook-ads-library-mcp.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
codex-app/scripts/harness/host.ts:40 const response = await fetch("/rpc", {Fallow Skills (Skill)
Compatibility: Not stated.
<p align="center"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/fallow-rs/fallow/main/assets/logo-dark.svg"> <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/fallow-rs/fallow/main/assets/lo
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/check_distribution_status.py:40 def fetch(url, *, token=None):Fantasy Football Manager (Plugin)
Compatibility: Codex.
ESPN draft and lineup tools for Codex and other MCP clients, with browser sign-in, approval modes, per-team limits, and server monitoring.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
package.json:14 prepareFastmail Mcp (MCP server)
Compatibility: Not stated.
An **unofficial** Model Context Protocol (MCP) server that provides access to the Fastmail API, enabling AI assistants to interact with email, contacts, and calendar data.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
README.md:421 subprocess.run(['trivy', 'image', 'myapp:latest'])FedRAMP 20x Requirements (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.KevinRabun/FedRAMP20xMCP -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
skills/image-gen/SKILL.md:574 curl -fsSL https://raw.githubusercontent.com/buildoak/fieldwork-skills/main/skilFieldwork Skills (Skill)
Compatibility: Not stated.
**Teach your AI agent to operate 10x better.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
skills/fiftyone-app-playwright/SKILL.md:43 os.remove(TRIGGER)fiftyone (Plugin)
Compatibility: Not stated.
Build high-quality datasets and computer vision models.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
workflow-skills/video-interaction-mapper/scripts/extract_key_frames.py:33 result = subprocess.run(cmd, capturefigma (Plugin)
Compatibility: Not stated.
Figma design platform integration.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:9 prepareFigma Mcp Bridge (MCP server)
Compatibility: Not stated.
Figma Plugin & MCP server to bypass API limits
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:27 postinstallfigwright (MCP server)
Compatibility: Not stated.
Free, two-way Figma MCP server.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
servers/files/scripts/build-mcpb.mjs:34 await fs.rm(out, { recursive: true, force: true });Files (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:40 prepareFileToPDF (MCP server)
Compatibility: Not stated.
A [Model Context Protocol](https://modelcontextprotocol.io) server for [FileToPDF](https://filetopdf.dev).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/filtalgo.js:43 if (now - fs.statSync(file).mtimeMs > stateLifetimeMs) fs.unlinkSync(file);Filtmall Shopping Skill (Skill)
Compatibility: Not stated.
Agent-native shopping for extreme value: verifiable same-product price evidence, checkout, orders, delivery, and after-sales.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:32 prepareFirecrawl Mcp Server (MCP server)
Compatibility: Portable across standard formats.
🔥 Official Firecrawl MCP Server - Adds powerful web scraping and search to Cursor, Claude and any other LLM clients.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/fisis/_accessor.py:6 ``f.life.company("0010001").fetch(list_no=..., ...)`` reads left to right --fisis (Plugin)
Compatibility: Not stated.
[English](https://github.com/seokhoonj/fisis/blob/main/README.en.md) | **한국어**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
flashloans/scripts/verify-contract.js:82 const response = await axios.post(config.apiUrl, new URLSearchParams(FlashBank (MCP server)
Compatibility: Not stated.
Non-custodial, on-chain lending where **your funds stay in your wallet until the moment they're used**.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
Flint-Server/api_server.py:147 process = subprocess.run(Flint (MCP server)
Compatibility: Not stated.
FastAPI + MCP stack that turns text prompts into Blender scenes and exports USDZ files via `export_model.py`.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zQyLO63o0" style="display:none">jTPwSCKZPIGq7hm4OdWImt2zBfMSjuxSk6JGxnW1Xbq7LvxCIIl7+/OjFlow Gated Planning (Plugin)
Compatibility: Not stated.
**SpecFlow Architect** is a revolutionary file-based planning system that transforms how developers, project managers, and AI agents collaborate on complex software projects.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
skills/diffdock/scripts/dock.py:64 result = subprocess.run(cmd, cwd=diffdock_dir)FM4Life (Skill)
Compatibility: Not stated.
<div align="center"> <img src="assets/logo.svg" alt="FM4Life , Skills for Life Science Foundation Models" width="100%"/> </div>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV +1 more
test_brands.ts:8 const resp = await axios.post(`${BASE_URL}/mcp?api_key=${API_KEY}`, {Fodda Brand Intelligence (MCP server)
Compatibility: Not stated.
Brand health & trend footprint across PSFK expert graphs with citable sources, not web summaries.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
lib/foobar2000_sdk/foobar2000/SDK/commonObjects.h:104 ret.fetch();foo_ui_webview2 (MCP server)
Compatibility: Not stated.
English | [中文](./README.zh-CN.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
README.md:241 You configure API keys in the `.env` file or via the profile configuration:Force Multiverse Hub (Plugin)
Compatibility: Not stated.
**Version 1.2.3 , Released January 2026**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
lib/distribution.js:55 if (!commands.has(path.basename(file,'.md'))) fs.rmSync(file);foreman (Plugin)
Compatibility: Portable across standard formats.
AI-powered strategic advisor for entrepreneurs.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
skills/forge-app-builder/scripts/create_forge_app.py:26 subprocess.run(['forge', '--version'], capture_output=Forge Skills (Plugin)
Compatibility: Not stated.
Forge-focused skills and MCP configuration for Atlassian Forge: scaffold and deploy apps (forge create, templates, dev spaces), build Teamwork Graph connectors for Rovo Search/Rovo Chat, pre-deploy review, systematic debugging, plus Forge docs and Atlassian Design System lookups
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
npm/install.js:193 else fs.unlinkSync(path.join(binDir, name));forgemax (MCP server)
Compatibility: Not stated.
**Code Mode MCP Gateway** , collapses N servers x M tools into 2 tools (~1,000 tokens).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:37 prepareforkmind (Plugin)
Compatibility: Not stated.
🧠 Local-first LLM state branching & debugging.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
src/fossick/github_client.py:268 result = subprocess.run(Fossick (MCP server)
Compatibility: Not stated.
<div align="center"> <img src="assets/logo.png" alt="Fossick" width="220" />
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
src/rules/database.rs:342 // SEC003-TS: Command Injection via os.system() (Python, tree-sitter)Fossil Mcp (MCP server)
Compatibility: Not stated.
**The code quality toolkit for the vibe coding era.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
src/fred_client/_config.py:8 3. ``"FRED_API_KEY"`` in ``$XDG_CONFIG_HOME/fred-client/credentials.json``Fred Client (Plugin)
Compatibility: Not stated.
**English** | [한국어](https://github.com/seokhoonj/fred-client/blob/main/README.ko.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
agent/experimental/cups-printer-status-adapter/adapter.py:33 completed = subprocess.run(free4chat (MCP server)
Compatibility: Not stated.
Temporary rooms for Humans and AI Agents , run, supervise and steer Agent Tasks without a permanent workspace.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:20 prepareFresh Jots (MCP server)
Compatibility: Not stated.
A [Model Context Protocol](https://modelcontextprotocol.io) (MCP) server for [Fresh Jots](https://freshjots.com).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST OBFUSCATION_MINIFIED_PAYLOAD
src/dashboard-server.js:6 const proxy=(req,res)=>{const p=http.request({hostname:'127.0.0.1',port:upstreamPortFRESH Shared URL Freshness Intelligence (MCP server)
Compatibility: Not stated.
**Know whether to fetch again.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
scripts/consumer-smoke.py:57 completed = subprocess.run(command, cwd=cwd, env=environment, text=True, check=FaFsMcp (MCP server)
Compatibility: Not stated.
**FsMcp is an idiomatic F# toolkit for building [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) servers and clients.** It wraps the official [Microsoft ModelContextProtocol .NET SDK](https://github.com/modelcontextprotocol/csharp-sdk) with computation expressions
This grade is a hygiene screen, not proof of safety.
