Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 951 to 1000 of 3,335 Grade C entries. Page 20 of 67.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST
ecommerce-1688-product-billboard/scripts/1688_product_billboard.py:71 os.remove(probe)Nexscope Ecommerce Skills (Skill)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
scripts/bootstrap-agent-docs.js:106 if (fs.existsSync(temporary)) fs.unlinkSync(temporary);nexus (MCP server)
Compatibility: Not stated.
Plugin-first Claude Code workflows with planning, CI/CD debugging, reusable agents, TODOs, and MCP safety policies.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
.agents/skills/brainstorming/scripts/server.cjs:645 if (fs.existsSync(eventsFile)) fs.unlinkSync(eventsFile);Ng Agentic Skills (Skill)
Compatibility: Not stated.
A library of **agent skills** for Angular work , focused, reusable capabilities an AI agent can invoke for signal forms, data access, SignalStore state, migrations, refactoring, accessibility, performance and security reviews, prototyping, unit and e2e tests, and verifying a fea
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
skills/ha-git-backup/scripts/backup_offsite.sh:32 REL_JSON="$(curl -sf "${AUTH[@]}" -X POST "$API/releases" \Nickol Knx (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.NickoScope/nickol-knx-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
gemeinsam.py:299 ca-certificates curl git jq procps \NightShift (Skill)
Compatibility: Not stated.
Two skills that turn Claude Code from an interactive tool into an autonomous worker.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
package.json:20 prepareNitrosend (MCP server)
Compatibility: Not stated.
Optional stdio bridge for [Nitrosend](https://nitrosend.com).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES SECRETS_PATH_DOTENV
scripts/noc.py:205 shutil.rmtree(backup)Noc Living Docs (Skill)
Compatibility: Not stated.
A local feature archive for Codex, with a CLI that handles setup and one-time project initialization.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
backend/frontend_builder.py:197 subprocess.run,nocturne_memory (MCP server)
Compatibility: Not stated.
A lightweight, rollbackable, and visual Long-Term Memory Server for MCP Agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
norman_mcp/files/download.py:96 shutil.rmtree(temp_dir, ignore_errors=True)Norman Mcp Server (Plugin)
Compatibility: Portable across standard formats.
AI-powered bookkeeping and tax filing automation for entrepreneurs at the heart of the European economy
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:39 prepareNostr Mcp (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server that enables AI models to interact with Nostr, allowing them to post notes and interact with the freedom of speech protocol.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
src/accounts/account-manager.ts:305 await fs.rm(accountDir, { recursive: true, force: true });Notebooklm Mcp (MCP server)
Compatibility: Not stated.
Automate Google NotebookLM at scale.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/bulk-delete.mjs:30 const res = await fetch(BASE_URL, {Notebooklm Mcp (MCP server)
Compatibility: Not stated.
Stop jumping between browser tabs.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES SECRETS_PATH_UNCONFIRMED
src/notebooklm_mcp_2026/auth.py:6 - Chrome launched via ``subprocess.Popen(list)`` - never ``shell=True``.Notebooklm Mcp 2026 (MCP server)
Compatibility: Not stated.
<img src="notebooklm_mcp_hero.png" alt="NotebookLM MCP" width="100%">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
scripts/build-mcpb.mjs:27 fs.rmSync(stage, { recursive: true, force: true });Notion Mcp Server (MCP server)
Compatibility: Not stated.
Give your AI read/write access to Notion with one token and one command.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
scripts/validate_repo.py:45 result = subprocess.run(Nsfc Benzi Audit (Skill)
Compatibility: Not stated.
<p align="center"> <img src="assets/nsfc-bamai-banner.svg" alt="NSFC 本子把脉" width="100%"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
core/nutmeg_core/bundle.py:150 freeze = subprocess.run(["python3", "-m", "pip", "freeze"], capture_output=Truenutmeg (Skill)
Compatibility: Not stated.
Football data analytics toolkit for Claude Code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES SECRETS_PATH_UNCONFIRMED
bench/make_oneshot.py:24 subprocess.run(nybls (Plugin)
Compatibility: Not stated.
Watch videos for your agent: summarize lectures, tutorials, webinars, recorded meetings, demos and screen recordings - YouTube or local files.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
docs/tips.md:65 r = requests.get(f"{BASE}/files", headers=HEADERS)Obsidian Cli Rest (MCP server)
Compatibility: Not stated.
Control your Obsidian vault programmatically.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
test-concurrent.js:81 const req = http.request(options, (res) => {Obsidian Mcp Plugin (MCP server)
Compatibility: Not stated.
High-performance Model Context Protocol (MCP) server for Obsidian that provides AI tools with direct vault access through semantic operations and HTTP transport.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
package.json:92 @cyanheads/mcp-ts-coreObsidian Mcp Server (MCP server)
Compatibility: Not stated.
Read, write, search, and surgically edit Obsidian vault notes, tags, and frontmatter via MCP.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
plugins/oc-security-audit/skills/oc-security-audit/scripts/scan.sh:2 set -u # Note: NOT set -e - npm audit andOc Security Audit (Skill)
Compatibility: Not stated.
*Dedicated to [Ohad Cohen](https://cohenron09.wixsite.com/boodi), a brave Israeli soldier who gave his life protecting Kibbutz Be'eri on October 7, 2023.*
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:42 prepareOctagon Mcp Server (MCP server)
Compatibility: Not stated.
Skills-first Claude Code plugin for Octagon market intelligence, prediction market research, and financial analysis workflows.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
skills/gh-address-comments/scripts/fetch_comments.py:96 p = subprocess.run(cmd, input=stdin, capture_output=TrOdin Codex Plugin (Plugin)
Compatibility: Not stated.
Outline-Driven Development for Codex CLI - methodology + skills + agents for OpenAI Codex coding workflows.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
cli/lazybones/commands/serve.py:22 subprocess.run(["npm", "ci"], cwd=frontend_dir, check=False)Oh My Lazybones (Skill)
Compatibility: Not stated.
<p align="center"><em>Laziness, automated.</em></p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
cmd/okf-benchmark/main.go:272 out, _ := exec.Command("sysctl", "-n", "machdep.cpu.brand_string").Output()Okf Agent Memory (MCP server)
Compatibility: Not stated.
Git-native persistent memory for AI coding agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:26 prepareolcli (MCP server)
Compatibility: Not stated.
Sync and manage Overleaf LaTeX projects from the command line.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:29 prepareOllama Mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST OBFUSCATION_MINIFIED_PAYLOAD
src/auth.js:10 wait handle.close().catch(()=>{});await fs.unlink(lockFile).catch(()=>{})}}catch(err){if(eONCE Exactly-Once Reliability for AI Agent Actions (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.GSterlingPress/once -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zvJTkXwp0" style="display:none">24APUfaFE9v8+e89okagQC1XQbFpkn/kRqTVNiiiUKLtnQNb9JVUoaW0One Maker Automation Engine (Plugin)
Compatibility: Not stated.
Solo Automation Suite 2026: Build Production-Grade Make Workflows with Official Modules for One-Person Businesses
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
scripts/run_local_installer.py:33 subprocess.run(Open Claude Design (Skill)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_UNNAMED_HOST SECRETS_PATH_UNCONFIRMED
package.json:38 prepareOpen Docs Mcp (MCP server)
Compatibility: Not stated.
An open-source MCP implementation providing document management functionality.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
npm/postinstall.js:33 fs.unlinkSync(tmp);Open Enthrium Ai Mcp Server (Plugin)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL OBFUSCATION_ENCODED_BLOB
python/01_calculate_natal_geo.py:40 response = requests.post(url, headers=headers, json=payload, params=paramsOpen Ephemeris (MCP server)
Compatibility: Not stated.
**Use it in Claude:** add `https://mcp.openephemeris.com/mcp` as a custom connector (leave the OAuth Client ID and Secret blank) or install the Open Ephemeris plugin from the Claude directory.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_MINIFIED_PAYLOAD
src/report.js:239 *{box-sizing:border-box}html{scroll-behavior:smooth}body{margin:0;background:radial-gradientOpen Skill Sunset (Skill)
Compatibility: Not stated.
[English](README.md) | [简体中文](README.zh-CN.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
install.mjs:373 fs.rmSync(staging, { recursive: true, force: true });Open Skills (Skill)
Compatibility: Not stated.
Reusable, inspectable skills for AI coding agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:42 postinstallopen_magi (Plugin)
Compatibility: Not stated.
OpenCode/codex cli/claude code cli plugin for Magi-style multi-agent code deliberation, with three read-only reviewers, artifact tracking, and verification gates.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
src/openclaw/client.ts:66 const response = await fetch(url, {Openclaw Mcp (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.freema/openclaw-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.opencode/plugins/README.md:7 | [`protect-secrets.js`](protect-secrets.js) | Blocks any tool call (read/write/Opencode Primer (Skill)
Compatibility: Not stated.
Master OpenCode, the open-source AI coding agent , setup, agents, skills, plugins, MCP, Zen & headless CI.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
package.json:85 @ff-labs/fff-nodeOpencode Ralph Rlm (Skill)
Compatibility: Not stated.
<p align="center"> <img src="docs/assets/ralph-rlm-overview.png" alt="Ralph-RLM: a coding loop you can hand off , outer loop (you + supervisor), inner loop (a fresh worker implements and runs verify until tests pass), optional parallel swarms, and why it works (memory in files,
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
plugins/opencode/scripts/opencode_review.py:239 def terminate_process_group(process: subprocess.Popen) -> NoneOpencode Review For Codex (Plugin)
Compatibility: Not stated.
<img src="assets/opencode-codex-plugin.webp" alt="OpenCode and Codex plugin header" width="100%">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/opendart_client/_endpoint.py:11 be routed silently through the flat fetch (the empty-frame trap).Opendart Client (Plugin)
Compatibility: Not stated.
Read Korean company filings, profiles, and financials from OpenDART (전자공시).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
monitoring/cli.py:246 done = subprocess.run(cmd, capture_output=True, timeout=900)Opentargets Mcp (MCP server)
Compatibility: Not stated.
A read-only MCP server for exploring targets, diseases, drugs and genetic evidence through the [Open Targets Platform](https://platform.opentargets.org/).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
packages/openwriter/scripts/prepublish.cjs:71 fs.rmSync(distPlugins, { recursive: true, force: true });openwriter (MCP server)
Compatibility: Not stated.
**Your agent writes.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
scripts/live_alert.py:432 with urllib.request.urlopen(request, timeout=20) as response:Opik Mcp (MCP server)
Compatibility: Not stated.
**The official Model Context Protocol (MCP) server for [Opik](https://github.com/comet-ml/opik), the open-source LLM observability and evaluation platform, built by [Comet](https://www.comet.com).** Plug your AI host (Claude Code, Cursor, VS Code Copilot, Codex, opencode, or any
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/mutate.py:601 finished = subprocess.run(Option Desk (MCP server)
Compatibility: Not stated.
Option analytics over the SYNTH sample or a permitted chain: Greeks, positioning, payoffs, plots.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV +1 more
infra/telemetry-worker/src/index.ts:17 await fetch(env.DISCORD_WEBHOOK_URL, {OrangePro (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="https://github.com/OrangeproAI/orangepro-mcp/raw/main/docs/logo-horizontal.svg" alt="OrangePro" width="320" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/package-smoke.mjs:56 fs.rmSync(temporary, { recursive: true, force: true });OrchestrUI (MCP server)
Compatibility: Not stated.
<p align="right"> <a href="README_RU.md">Русская версия</a> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
organize-files-safely/scripts/organize_files.py:428 df_result = subprocess.run(Organize Files Safely (Skill)
Compatibility: Not stated.
[Português](README.pt-BR.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
scripts/release_audit.py:79 completed = subprocess.run(Origin Com Automation (Plugin)
Compatibility: Not stated.
Safe OriginLab COM automation plugin for Codex on Windows.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:18 prepareOutline Mcp Server (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server for [Outline](https://www.getoutline.com/) that enables reading and writing documents through the Outline API.
This grade is a hygiene screen, not proof of safety.
