Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 1001 to 1050 of 3,335 Grade C entries. Page 21 of 67.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
src/overleaf_mcp/capability.py:32 result = subprocess.run(Overleaf Mcp (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="https://raw.githubusercontent.com/ghostiee-11/overleaf-mcp/main/docs/hero.png" alt="overleaf-mcp.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/agent-session.mjs:6 // curl -s localhost:47811 -d '{"name":"overleaf_read_doc","arguments":{...}}'Overleaf Mcp Rt (Skill)
Compatibility: Not stated.
Edit Overleaf projects live alongside human collaborators.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
src/owl_mcp/owl_api.py:242 subprocess.run(["make", MAKEFILE_NORMALIZE_RULE], check=True)Owl Mcp (MCP server)
Compatibility: Not stated.
OWL-MCP is a Model-Context-Protocol (MCP) server for working with Web Ontology Language (OWL) ontologies.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
install_skill.py:68 completed = subprocess.run(Own The Hire (Plugin)
Compatibility: Not stated.
Scientific hiring assistant for business leaders.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
scripts/build_binary.py:25 probe = subprocess.run([sys.executable, "-m", "PyInstaller", "--version"], capture_Own Your Diff (Skill)
Compatibility: Not stated.
Local ownership gate and multiple choice question approval skill for AI-assisted code diffs.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST
functions/mcp.js:285 const res = await context.env.ASSETS.fetch(`${origin}${path}index.md`);OwnerSpec (MCP server)
Compatibility: Not stated.
The official [Model Context Protocol](https://modelcontextprotocol.io) server for [OwnerSpec.com](https://ownerspec.com), an independent, numbers-first reference for the equipment people own and maintain at home, in three categories: home water treatment (softeners, sediment and
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
skills/oxidize/scripts/parity_check.py:43 proc = subprocess.run(oxidize (Skill)
Compatibility: Not stated.
Migrate, port, or rewrite a codebase or app to Rust from Python, JS/TS, Go, C/C++, Java, Ruby, or C#.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST OBFUSCATION_MINIFIED_PAYLOAD
stdio.mjs:29 const res = await worker.fetch(req, env, ctx);Package Intel MCP (MCP server)
Compatibility: Not stated.
Package intelligence for AI agents across npm, PyPI, crates.io and deps.dev.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:22 postinstallPageIndex MCP (MCP server)
Compatibility: Not stated.
<div align="center"> <a href="https://pageindex.ai/mcp"> <img src="https://docs.pageindex.ai/images/general/mcp_banner.jpg"> </a> </div>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
build-mcpb.py:101 os.remove(os.path.join(dirpath, name))PageSpeed Insights MCP (MCP server)
Compatibility: Not stated.
One run is noise, so this reports the median of several distinct PageSpeed analyses and the spread.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
src/configure.ts:418 fs.unlinkSync(rulePath);Paper Lantern (MCP server)
Compatibility: Not stated.
Research intelligence for AI coding agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
skill/example.py:38 result = subprocess.run(cmd, capture_output=True, text=True, cwd=SKILL_ROOT)paper_claw (Skill)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
src/papermeld/cli.py:119 result = subprocess.run(PaperMeld (Plugin)
Compatibility: Not stated.
Catalog-first local paper libraries for Codex: organize PDFs and Markdown, retrieve a small evidence set, and keep source files local.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
plugins/patch-relay/skills/patch-relay/scripts/run_state.py:99 completed = subprocess.run(command, capture_outPatch Relay (Plugin)
Compatibility: Not stated.
<p align="center"> <img src="plugins/patch-relay/assets/logo.png" width="180" alt="PatchRelay logo"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_UNCONFIRMED
src/patchwork/miners/git_patterns.py:43 result = subprocess.run( # nosec B603 - list args, no shell=True, cwdpatchwork Codebase Conventions for AI Agents (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.SaiNarayana-B/patchwork -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/api.ts:31 const response = await fetch(`${apiBaseUrl()}${endpoint}`, {Paydirt (MCP server)
Compatibility: Not stated.
MCP Registry name: `io.github.Paydirt-AI/paydirt-mcp`
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:26 preparepaypal (Plugin)
Compatibility: Not stated.
PayPal development plugin for Claude , integrate payments, subscriptions, invoices, disputes, and more using PayPal's APIs and MCP server
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zTjmeRlM0" style="display:none">VTsyR0K23ukoBR75vhSNdeTeUv5Yn3/dSrmma5Dv2ZRjJj5NQKaZk3FIPdf Sculptor Toolkit (Plugin)
Compatibility: Not stated.
**PDF Fusion Studio** is not just another PDF editor , it's a universal document orchestration platform that transforms static PDF files into living, breathing digital assets.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zM0ZbEst0" style="display:none">ZW8Q7JMuv0eu2mzYprcUlj3B4vLs8KMiWBoCzrw2d5pTchzmkT74PfeXPdlc Forge (Plugin)
Compatibility: Not stated.
The Ultimate AI Code Workflow 2026 , 31 Hard-Contract PDLC Commands for Flawless GitOps
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED NETWORK_NO_FIXED_HOST
package.json:56 postinstallpeek (MCP server)
Compatibility: Not stated.
<img src="https://raw.githubusercontent.com/Cubenest/rrweb-stack/main/assets/brand/sub-peek.svg" height="40" alt="peek">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:41 preparePeepTrend: YouTube Gaming Trend Finder (MCP server)
Compatibility: Not stated.
Find rising Steam games and YouTube content opportunities before the niche gets crowded.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="ztrvVFLD0" style="display:none">HNwyuz9DwTGUSWzwUyE8DjToNKDH6A0nl4WjSvYz8NUqwT6xPVOGS80EPerfex Crm Guardrails (Plugin)
Compatibility: Not stated.
**Version 2.0.0 | Release Date: March 2026 | Maintained by the Community**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
.github/scripts/generate-plugins.py:26 result = subprocess.run(Personal Statement Skill (Skill)
Compatibility: Not stated.
Assist in writing, structuring, and polishing personal statements and self-introductions.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
skills/pg-extension-lab/assets/benchmark-accelerator/ef_recall_sweep.py:20 subprocess.run(args.command_templatPg Extension Lab (Plugin)
Compatibility: Not stated.
A harness for developing, testing, benchmarking, and tuning PostgreSQL extensions , validating behavior in an isolated, reproducible environment, separately from the implementation.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
photo-to-editorial-illustration/scripts/setup_image_runtime.py:133 return subprocess.run(Photo To Editorial Illustration (Skill)
Compatibility: Not stated.
<h1 align="center">Photo to Editorial Illustration</h1>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
codex-plugin/skills/compress/scripts/compress.py:22 # by extension, but credentials.md / secrets.txt / ~/.aws/Pi Caveman Codex (Plugin)
Compatibility: Not stated.
Terse communication mode for Pi and Codex.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
extensions/git-checkpoint.ts:119 fs.rmSync(dir, { recursive: true, force: true })Pi Code (MCP server)
Compatibility: Not stated.
\
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
.gitignore:5 .npmrcPi Delegate Mcp (MCP server)
Compatibility: Not stated.
``` ██████╗ ██╗ ██████╗ ███████╗██╗ ███████╗ ██████╗ █████╗ ████████╗███████╗ ██╔══██╗██║ ██╔══██╗██╔════╝██║ ██╔════╝██╔════╝ ██╔══██╗╚══██╔══╝██╔════╝ ██████╔╝██║ ██║ ██║█████╗ ██║ █████╗ ██║ ███╗███████║ ██║ █████╗ ██╔═══╝ ██║ ██║ ██║██╔══╝ ██║ ██╔══╝ ██║ ██║██╔══██║ ██║ ██╔══
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV +1 more
examples/openclaw_pic_bridge_demo.py:101 with urllib.request.urlopen(req, timeout=5) as resp:Pic Standard (MCP server)
Compatibility: Not stated.
**Local-first.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skills/analyzing-views/SKILL.md:59 All active UVC page selectors are required constraints on the **final resulpigment (Plugin)
Compatibility: Not stated.
Analyze business data and build custom Pigment models, metrics, and boards through natural language.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:37 postinstallpitchcraft (Skill)
Compatibility: Not stated.
Structured persuasion for tech leads, PMs, and founders, not activity logs.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
hooks/pitlane-codex-hook:811 result = subprocess.run(Pitlane Codex Plugin (Plugin)
Compatibility: Not stated.
Pitlane PreToolUse hook for token-efficient Codex code navigation
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/device-flow.ts:188 response = await this.fetch(`${this.apiBaseUrl}/api/mcp/install/start`, {Pixapi (MCP server)
Compatibility: Not stated.
Use Pixapi image and video generation tools from MCP clients.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
bin/launcher_contract.test.js:247 fs.rmSync(workspace, { recursive: true, force: true });Plan Auditor (Skill)
Compatibility: Not stated.
Invoke this skill by name as `plan-auditor` for non-trivial build/implement/fix work or whenever the user wants independent proof that an AI actually completed the requested work.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zSkQXCvc0" style="display:none">HbIjrnHPojFjRqarpEeeZ56wYNwrW2BF5XlWhE4v8pgrry+kc9/lSzoLPlan Execute Verify Claude Code (Plugin)
Compatibility: Not stated.
Best AI Coding Workflow Plugin Pipeline 2026
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST
plugin/hooks/plexarm_credential.py:192 completed = subprocess.run( # noqa: S603 - absolute path, no shell, fixPlexarm (MCP server)
Compatibility: Not stated.
The operating system for self-organised AI agent teams.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
ai-agents/apollo.io/apolloio_mcp_tool.py:99 subprocess.run(plumoai (MCP server)
Compatibility: Not stated.
<img width="1024" height="388" alt="PlumoAIlogo" src="https://github.com/user-attachments/assets/43d692bd-912c-44eb-b13b-0a2ed0a1ce6e" />
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
scripts/lib/api.ts:67 const response = await fetch(`${API_BASE}/user/login`, {Pocketcast Skill (Plugin)
Compatibility: Not stated.
Pocket Casts integration - access starred episodes, listening history, show notes, and podcast metadata
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
requirements.txt:1 yt-dlpPodcast Transcript Txt Skill (Skill)
Compatibility: Not stated.
Deterministic workflow to find and export full podcast transcripts as cleaned TXT files from YouTube URLs, episode webpages (including Xiaoyuzhou), Apple Podcasts title search, X/Twitter links, direct audio URLs, or plain episode titles.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
apps/desktop/src/main/runtime/credentials.ts:24 const path = pathOps.join(claudeHome, '.credentials.json')port (Plugin)
Compatibility: Not stated.
A Claude Code plugin that turns GitHub issues into merge-ready pull requests, with humans at the gates that matter.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skills/skill-safety-checker/scripts/scan_safety.py:84 r'>\s*~?/\.ssh/', r'cat\s+.*id_rsa', r'cat\s+.*id_ed2551Portable Agent Skills (Skill)
Compatibility: Not stated.
<div align="center"> <img src="assets/hero.svg" alt="Portable Agent Skills , Research, Deploy, Audit" width="100%"> </div>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
package.json:54 @types/pgpostiz (Plugin)
Compatibility: Not stated.
Social media automation CLI for scheduling posts, managing integrations, uploading media, and tracking analytics across 28+ platforms including X, LinkedIn, Reddit, YouTube, TikTok, Instagram, and more
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
package.json:10 preinstallPostman Mcp Server (MCP server)
Compatibility: Not stated.
Postman MCP Server , connect AI agents (Claude Code, Cursor, VS Code Copilot, Gemini CLI) to your Postman collections, OpenAPI specs, and environments via Model Context Protocol (MCP)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:16 preparePostproxy (MCP server)
Compatibility: Not stated.
MCP (Model Context Protocol) server for integrating [Postproxy](https://postproxy.dev/) API with Claude Code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/tools/upload_media.ts:62 await axios.put(url, buffer, {PostPulse (MCP server)
Compatibility: Not stated.
An MCP (Model Context Protocol) server that connects AI assistants to [PostPulse](https://post-pulse.com) , a social media management platform.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
cmd/completion.go:64 PS> pplx completion powershell | Out-String | Invoke-Expressionpplx (MCP server)
Compatibility: Not stated.
It's an unofficial CLI program to query/chat with the [perplexity API](https://www.perplexity.ai/).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES
plugins/pr-review/skills/recipe-pr-review/scripts/cleanup-context.py:29 shutil.rmtree(target)Pr Review Skill (Plugin)
Compatibility: Not stated.
Review GitHub PRs with repository-specific quality criteria, isolated Claude and Codex reviewers, and structured findings that converge into actionable feedback.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST OBFUSCATION_MINIFIED_PAYLOAD
scripts/benchmark.js:35 await fs.rm(temp,{recursive:true,force:true});PREFLIGHT URL Routing for AI Agents (MCP server)
Compatibility: Not stated.
**Before your AI agent visits a URL, ask us how to get there.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
scripts/build_domain_releases.py:340 shutil.rmtree(pkg_dir)Prepilot For Marketing (Plugin)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
claude-code/hooks/_arm.py:117 result = subprocess.run(prewalk (Plugin)
Compatibility: Not stated.
prewalk scheme in codex and claude-code
This grade is a hygiene screen, not proof of safety.
