Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 1101 to 1150 of 3,335 Grade C entries. Page 23 of 67.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
requirements.txt:2 mcp>=1.0.0revula (MCP server)
Compatibility: Not stated.
**Production-grade MCP server for universal reverse engineering automation.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
plugins/lean-verify/scripts/lean_develop.py:165 Process = subprocess.Popen(Command, cwd=Root, stdout=subprocesRigorous Open Math Research (Plugin)
Compatibility: Not stated.
Codex skills for rigorous open mathematics research, research-program management, and Lean 4 formal verification (rigorous-open-math-research + manage-math-research-program + lean-verify plugin + math-research-workflow pipeline).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:40 prepareRis Mcp Ts (MCP server)
Compatibility: Not stated.
An [MCP (Model Context Protocol)](https://modelcontextprotocol.io/) server that gives AI assistants access to Austria's official legal database , the **Rechtsinformationssystem (RIS)**.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
skills/docker-ros2-development/SKILL.md:496 curl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey \Robotics Agent Skills (Skill)
Compatibility: Not stated.
Agent skills that make AI coding assistants write production-grade robotics software.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
evals/catalog.py:14 commit = subprocess.check_output(Robust Skills (Skill)
Compatibility: Not stated.
Task-specific engineering skills for Bazel, backend and frontend architecture, JavaScript, CSS, PostgreSQL/Drizzle, Mermaid, Slack, and Microsoft Teams.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED SECRETS_PATH_UNCONFIRMED OBFUSCATION_MINIFIED_PAYLOAD
package.json:3 terserRod Mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
rules/fastapi-anti-patterns.mdc:142 - `subprocess.run()` - use `asyncio.create_subprocess_exec()`Roninforge Fastapi (Plugin)
Compatibility: Not stated.
Cursor plugin for FastAPI + Pydantic v2.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
rules/terraform-core.mdc:282 The provider picks up credentials from `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KRoninforge Terraform (Plugin)
Compatibility: Not stated.
Cursor plugin for Terraform 1.9+ and OpenTofu 1.8+.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
hooks/rtk-codex-hook:441 result = subprocess.run(Rtk Codex Plugin (Plugin)
Compatibility: Not stated.
<h1 align="center">RTK Codex Plugin</h1>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
endpoint/rest/rest_test.go:730 code, body := fetch("http://" + addr + "/static/index.html")rulego (MCP server)
Compatibility: Not stated.
⛓️RuleGo is a lightweight, high-performance, embedded, next-generation component orchestration rule engine framework for Go.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
scripts/check-registry-version.py:21 with urllib.request.urlopen(REGISTRY + query, timeout=20) as r:RuSender (MCP server)
Compatibility: Not stated.
Управление email-рассылками RuSender из ассистента: статистика кампаний, база контактов, сегменты, A/B-тесты, домены и доставляемость.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
scripts/generate-docs.py:28 subprocess.run(["cargo", "build", "--release"], check=True)Rust Mcp Server (MCP server)
Compatibility: Not stated.
`rust-mcp-server` is a server that implements the [Model Context Protocol (MCP)](https://modelcontextprotocol.io/introduction).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
src/sac/cli.py:349 shutil.rmtree(skill_dir)SaC Software as Content (MCP server)
Compatibility: Not stated.
Give your AI agent the ability to respond with live, interactive apps that evolve.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:29 prepareSafari DevTools MCP (MCP server)
Compatibility: Not stated.
`safari-devtools-mcp` lets your coding agent (such as Claude, Cursor, Copilot or Gemini) control and inspect a live Safari browser on macOS.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
scripts/create_demo_video_assets.py:26 proc = subprocess.run(SAGE Wrapper (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.PsYcGoD/sage -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="ziCtxHk20" style="display:none">4/z8aULEWdNZjtvOixK3mTJKs7pXwI4n1SF5eaSWrhPV4fBjQNQeqQDDSageox Hivemind Engine (Plugin)
Compatibility: Not stated.
⚡ SageOx HiveMind 2026 , Agentic Engineering Toolkit for Autonomous Workflows
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/public_release_audit.sh:17 \( -name ".env" -o -name ".env.*" -o -name "auth.json" -o -name "credentialSalesflow Plugin (Plugin)
Compatibility: Not stated.
Open-source bilingual sales workflow plugin for Codex, Claude Code, ChatGPT, and Synaro.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zONcMfc20" style="display:none">XtgMWd+4bH6JrEwpOo8fljuO6pQoQ42bIzsrNylPfLRoxQBT3agrBNDhSalesforce Accelerator Patterns (Plugin)
Compatibility: Not stated.
> **Transform your Salesforce delivery velocity in 2026** , Ship production-ready skills, automations, and integrations 3x faster with pre-built, reusable components engineered for ISVs and consulting partners.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +1 more
package.json:17 prepareSamsara MCP (MCP server)
Compatibility: Not stated.
> **Complete Samsara Fleet Management integration for Claude AI** > 21 tools | Expert knowledge built-in | Beta
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
e2e/tls_test.go:69 cmd := exec.CommandContext(t.Context(), bin, "run", "--config", configPath)sandbox (MCP server)
Compatibility: Not stated.
MicroVM sandboxes for AI agents, built on [cocoon](https://github.com/cocoonstack/cocoon): a fast-boot guest stack, an in-guest product daemon, a per-node control plane with warm pools, and SDKs for Go and Python.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
scripts/build_release.py:184 proc = subprocess.run([sys.executable, str(validate_script)], capture_output=TrueSatori (Skill)
Compatibility: Not stated.
Clinically informed wisdom companion for the inner life , emotions, grief, meaning, burnout, relationship conflict, shadow work, and existential crossroads.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
skills/save-to-spotify/references/audio-providers.md:344 out = subprocess.check_output(Save To Spotify (Plugin)
Compatibility: Not stated.
Create polished audio episodes with TTS narration, rich timelines, cover images, and save them to Spotify via the save-to-spotify CLI.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
commands/sofa.md:106 resp=$(curl -s -X POST \scaffolding (Plugin)
Compatibility: Not stated.
Spec-driven multi-agent orchestration plugin for Claude Code , 13 agents, 35 skills, per-phase model tiers, opt-in lifecycle hooks, and optional cross-device semantic memory.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
scripts/schema-sync.mjs:75 const res = await fetch(`${BASE}${path}`, { headers });Scholar Feed (MCP server)
Compatibility: Not stated.
Search 600,000+ CS/AI/ML papers with LLM novelty analysis, citation graph, full-text extraction, and BibTeX, without leaving Claude Code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +2 more
benchmarks/run_benchmark.py:52 "os.system() call",Scout Security (MCP server)
Compatibility: Not stated.
Deterministic security scanner for AI-assisted coding.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
scoville-code/scripts/check_text_size.py:102 result = subprocess.run(command, stdout=subprocess.PIPE, stderr=sScoville Code (Skill)
Compatibility: Not stated.
Passing tests are useful.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:29 prepareScrapingdog (MCP server)
Compatibility: Not stated.
A [Model Context Protocol](https://modelcontextprotocol.io) server that exposes the [Scrapingdog](https://www.scrapingdog.com) web-scraping and SERP APIs as tools any MCP-compatible client (Claude Desktop, Claude Code, Cursor, etc.) can call.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
amazon-skills/amazon-official/sealeap-amazon-listing-optimizer/scripts/sorftime_plan.py:121 completed = subproSealeap Amazon Skills (Skill)
Compatibility: Not stated.
Reusable Agent Skills for Amazon product research, listings, advertising, inventory, and operations.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
README.md:10 curl -fsSL https://cli.search1api.com/install.sh | bashSearch1Api Cli (Skill)
Compatibility: Not stated.
Command-line interface for [Search1API](https://s1.dev) , web search, news, crawl, sitemap, trending, and turning a URL into an Agent Skill, from your terminal.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
assets/site/pages-data.js:2 window.SBOS_PAGES={"01-concepts/what-is-a-second-brain":{"html":"<p>One local foldSecond Brain Os (Skill)
Compatibility: Not stated.
An AI second brain that maintains itself.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
evals/authz-fail-open/fixture/server.js:47 const res = await fetch(POLICY_URL, {securitymaxxing (Plugin)
Compatibility: Not stated.
Evidence-based application security for Claude Code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:13 postinstallsemaphore (Plugin)
Compatibility: Not stated.
AI Agent status indicator for your desk
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
semhood/client.py:98 subprocess.Popen(cmd, **kwargs)semhood (MCP server)
Compatibility: Not stated.
Use semantic code search before reading files.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
docs/pay/button.js:34 return fetch(API_BASE + '/v1/checkout/invoices', {Seneschal Data (MCP server)
Compatibility: Not stated.
Free, public REST + [Model Context Protocol](https://modelcontextprotocol.io) server exposing real-time and historical DeFi liquidation telemetry for Aave, Morpho, Spark and Compound on Ethereum mainnet, plus block-builder market share data from the operator's own slot-by-slot sh
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
adapters/doubao/install_doubao.py:74 return subprocess.check_output(Senmu Buildos (Plugin)
Compatibility: Not stated.
AI-native BuildOS for Codex, Claude Code, Doubao, WorkBuddy and ZCode: product discovery, UI/UX design, software engineering, context-aware workflows, testing, Git and verifiable releases.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
src/seo_mcp/cli.py:155 with urllib.request.urlopen(req, timeout=15) as resp: # noqa: S310 (trusted user URL)Seo Monster (MCP server)
Compatibility: Not stated.
SEOMonster: a local, user-credential-driven MCP server for SEO workflows over Google Search Console, GA4, PageSpeed Insights, and Cloudflare.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
CSDN-宣传稿.md:115 "OPS_SSH_KEY": "~/.ssh/id_rsa"Server Ops MCP (MCP server)
Compatibility: Not stated.
**English** | [简体中文](./README.zh-CN.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_UNPINNED SECRETS_PATH_CREDENTIAL +1 more
scripts/security_sanitizer.py:167 result = subprocess.run(Servicenow Api (MCP server)
Compatibility: Not stated.
*Version: 2.2.0*
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
plugins/setup-vscode-swift/skills/setup-vscode-swift/scripts/setup_vscode_swift.py:26 return subprocess.run(Setup Vscode Swift (Plugin)
Compatibility: Not stated.
Claude Code and Codex plugin that automates VS Code setup for Swift and Xcode on macOS
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
.gitignore:30 credentials.jsonSf Metadata Parser (Plugin)
Compatibility: Not stated.
Parse SAP SuccessFactors OData $metadata XML into user-friendly Excel data dictionaries, Word reports, CSV exports, HTML interactive views, and instance comparison reports.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
plugins/shahar-polaks-career-studio/skills/shahar-cv-optimizer/eval/run_eval.py:83 result = subprocess.run(Shahar Polaks Career Studio (Plugin)
Compatibility: Not stated.
Truthful, ATS-safe CV tailoring, LinkedIn positioning, job-fit analysis, and interview preparation for Hebrew- and English-speaking professionals.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV +1 more
src/shelfmark/refresh.py:151 shutil.rmtree(self.dir)Shelfmark (MCP server)
Compatibility: Not stated.
**Give AI agents the right context, not your entire filesystem.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/gate_audit.py:61 r = subprocess.run(['cmd', '/c', cmd], cwd=cwd, capture_output=True,Shisan Xinuo Workflow (Skill)
Compatibility: Not stated.
> **v4.2.0**（2026-10-14 已发 GitHub Release · npm/Gitee/About 待批 · 上一全渠道发行态 v4.1.0 / 2026-10-12）· MIT · 中文为主 · [GitHub 源库](https://github.com/zxc663/shisan-xinuo-workflow)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:26 prepareShopify Admin MCP (MCP server)
Compatibility: Not stated.
MCP server for the Shopify Admin API (GraphQL): products, orders, customers, inventory and discounts for AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_UNNAMED_HOST SECRETS_PATH_UNCONFIRMED
SKILL.md:111 out = subprocess.run(["gh", "api", url], capture_output=True, text=True)Should I Contribute (Skill)
Compatibility: Not stated.
Research any open-source repository end to end and answer the core question , SHOULD YOU contribute to it?
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
skills/shuling/scripts/preflight.py:128 result = subprocess.run(Shuling Skill (Skill)
Compatibility: Not stated.
Public repository laiyangjun-dotcom/shuling-skill.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/smoke-mcp.mjs:25 const challengeResponse = await fetch(endpoint, {Sideshift Mcp Server (Plugin)
Compatibility: Not stated.
Official Cursor plugin for SideShift's hosted MCP server.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
plugins/sift-light/concept-worker.mjs:429 const response = await fetch(`https://huggingface.co/${CONCEPT_MODELSift Light (MCP server)
Compatibility: Not stated.
English · [简体中文](README.zh-CN.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
skills/sigma-legal-bid-workflow/scripts/check_environment.py:180 completed = subprocess.run(Sigma Legal Bid Workflow (Skill)
Compatibility: Not stated.
**西格玛小鬼出品｜律师投标工作流**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
websites/tasks.py:324 result = subprocess.run(Silicon Friendly (MCP server)
Compatibility: Not stated.
Check if any website on the internet is AI-agent-friendly.
This grade is a hygiene screen, not proof of safety.
