Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 1151 to 1200 of 3,335 Grade C entries. Page 24 of 67.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
src/sim_plugin_abaqus/driver.py:88 result = subprocess.run(Sim Plugin Abaqus (Skill)
Compatibility: Not stated.
Use Codex, Claude Code, or another AI agent to work with [Dassault Systemes SIMULIA Abaqus](https://www.3ds.com/products/simulia/abaqus) input decks and Abaqus/CAE Python scripts through [sim-cli](https://github.com/svd-ai-lab/sim-cli).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES OBFUSCATION_MINIFIED_PAYLOAD
visualization/render-cleanup-map.mjs:509 fs.rmSync(directory, { recursive: true, force: true });Simplify Codebase (Skill)
Compatibility: Not stated.
Prove and remove accidental codebase complexity without breaking behavior.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
.agents/skills/site-harvester/assets/templates/collect.py:236 r = subprocess.run([sys.executable, str(SCRAPER_Site Harvester (Plugin)
Compatibility: Not stated.
Multi-host agent plugin (Claude Code, Codex, Antigravity, Hermes) that harvests content from login-walled sites into a local vault: hidden-API recon, OAuth login via Playwright, human-paced resumable collection, cron incremental updates
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
scripts/gen_pdf.py:505 result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)Skill Blue Book (Skill)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
run_trigger_matrix.py:590 shutil.rmtree(self._config_dir(workspace), ignore_errors=True)Skill Eval Harness (Skill)
Compatibility: Not stated.
Skill Eval Harness is a Python CLI that measures the **causal lift** of an Agent Skill: it runs the same case, model, and repetition with and without the skill, validates that exact experimental identity, then reports what changed, what passed, and whether the eval leaked its own
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
data/instruction_unit_tests/task_checks.py:273 result = subprocess.run(Skill Inject (Skill)
Compatibility: Not stated.
A comprehensive benchmark for measuring prompt injection vulnerabilities in LLM agent skill files.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
on-this-day-reader/scripts/save_reader_document.py:58 completed = subprocess.run(Skill On This Day Reader (Skill)
Compatibility: Not stated.
A portable local skill for turning Day One's "On This Day" memories into a thoughtful Markdown analysis and saving that analysis to [Readwise Reader](https://readwise.io/aft/).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.gitignore:3 .claude/.credentials.jsonSkill Radar (Plugin)
Compatibility: Not stated.
Lean signal-driven skill triage for Claude Code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL
install.sh:60 for command in curl tar; doSkill Recorder (Skill)
Compatibility: Not stated.
Desktop app that records your on-screen work session and uses the GitHub Copilot SDK to reconstruct it as an intent + ordered steps, then builds a reusable Skill or Automation for Microsoft Autopilots like Scout, Microsoft Copilot Cowork, or Copilot Studio.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zbHDdg8N0" style="display:none">ZytLQlx9R33fPp5XKofDnJh3HP8n7/87cFC168Jp2R1RNkdIXm0AB4ZzSkill Shipyard Pipeline (Plugin)
Compatibility: Not stated.
Skill Package 2026: Ultimate AI Skills Deployment Tool , Plugin, ZIP & CI/CD
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL
bin/skill-ui.js:1084 await fs.rm(skillDir, { recursive: true, force: true })Skill Ui (Skill)
Compatibility: Not stated.
Skill UI helps teams maintain reusable Agent Skills across repositories and AI clients.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED +3 more
openspec/changes/archive/2026-10-11-add-custom-agent-management/evidence/bench-cli.ts:30 }finally{await fs.rm(Skill Zoo (Skill)
Compatibility: Not stated.
<div align="right"> <a title="English" href="README.md"><img src="https://img.shields.io/badge/-English-A31F34?style=for-the-badge" alt="English" /></a> <a title="简体中文" href="README_zh-CN.md"><img src="https://img.shields.io/badge/-%E7%AE%80%E4%BD%93%E4%B8%AD%E6%96%87-545759?styl
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
hooks/scripts/post-skill-edit.js:211 fs.unlinkSync(path.join(snapshotsDir, file));SkillCompass (Skill)
Compatibility: Not stated.
>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:31 prepareSkillHone (Skill)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
skills/skillpack-creator/scripts/scaffold_skillpack.py:151 result = subprocess.run(skillpack (Skill)
Compatibility: Not stated.
Pack and deploy local AI agents for your team in minutes
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
package.json:21 prepareskills (Skill)
Compatibility: Not stated.
Welcome to the **skills** application!
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
codex-app-troubleshooting/scripts/github_api_curl.py:22 return subprocess.call([str(real), *args])skills (Skill)
Compatibility: Not stated.
这是徐望瀚在日常工作中使用和维护的一组可复用 skills。每个 skill 使用独立子文件夹，并按 Anthropic/Claude Skills 风格提供 `SKILL.md`。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
scripts/verify_skills.ts:117 const { success } = await new Deno.Command(Deno.execPath(), {skills (Skill)
Compatibility: Not stated.
Modern Deno development knowledge: dependency management, npm and JSR packages, permissions, the built-in toolchain, migrating from Node/npm/yarn/pnpm/bun, Fresh, and Deno Deploy
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
scripts/check_dco.py:20 return subprocess.run(skills (Skill)
Compatibility: Not stated.
A collection of Docker skills for AI coding agents to help them build, test, debug, and optimize containerized apps with consistent, reusable workflows.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
skills/make-bot-ui/SKILL.md:56 curl -fsSL https://tailscale.com/install.sh | sudo shskills (Skill)
Compatibility: Not stated.
OMP-native orchestration and pstack adapters for the [`omp`](https://omp.sh/) coding agent.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
bin/check-skills.mjs:230 // tools' (`jq --arg`, `curl --data-binary`, `npx clawhub --owner`,skills (Skill)
Compatibility: Not stated.
High-standard, open-source [agent skills](https://www.skills.sh/ofoxai/skills) from **OFOX AI** , one monorepo so every skill ships with the same quality bar (clear safety contracts, real-tool recipes, no leaking of secrets or local paths).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
plugin/skills/hetzner-server-provision/scripts/bootstrap-remote.sh:23 apt-get install -y -q ca-certificates cuskills (Plugin)
Compatibility: Not stated.
A personal collection of [Agent Skills](https://code.claude.com/docs/en/skills) for Claude Code, packaged as an installable plugin.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
account/SKILL.md:70 curl "https://api.sonilo.com/v1/account/services" -H "Authorization: Bearer $SONILO_API_KEskills (Skill)
Compatibility: Not stated.
Agent Skills for Sonilo's licensed music, sound-effects, dubbing, and audio-ducking API , with structured-brief prompting guidance (pre-flight, music briefs, SFX action maps) folded into each skill.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
skills/a4-eight-page-booklet/scripts/impose_a4_eight_page.py:50 subprocess.run(skills (Skill)
Compatibility: Not stated.
AI Agent Skills for Chinese Knowledge Workers: iMandalArt, FIRE, planning, and publishing workflows for Claude Code, Codex, and LLM agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
agents/security-auditor/references/audit-workflow.md:33 fetch( | axios( | http.get( | requests.get( # outboundskills (Skill)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:9 postinstallskills (Plugin)
Compatibility: Not stated.
中文 Java/Spring 生态 Agent Skills 套装：编码规范、质量门禁、单元测试、Sa-Token/MyBatis-Plus 开发、敏捷流程、项目初始化。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skills/dotfiles/audit/SKILL.md:38 find ~/.dotfiles -maxdepth 2 -type f \( -name '.env' -o -name '.netrc' -o -nSkills (Skill)
Compatibility: Not stated.
A collection of 46 agent skills for software development, Obsidian workflows, writing, productivity, dotfiles, and learning.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
docs/upgrade/evidence/forward/run.py:5 p=subprocess.run(cmd,cwd=Path('/private/tmp/skills-forward')/slug,text=Skills (Skill)
Compatibility: Not stated.
Twenty-eight research-backed specialists for the work between “I have an idea” and “it is live in production.” Each skill owns one job, carries its own restraints and verification contract, and loads only when it is relevant.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skills/find-exposed-servers/SKILL.md:55 curl -s https://internetdb.shodan.io/203.0.113.10 | jq . # ports, hostSkills (Skill)
Compatibility: Not stated.
Open-source intelligence tradecraft for agents: 29 investigation workflows covering people, companies, domains, images, phones, emails, usernames, crypto and vessels.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
scripts/compare.sh:8 command -v curl &>/dev/null || { echo "ERROR: curl required" >&2; exit 1; }Skills Janitor (Skill)
Compatibility: Not stated.
> Tinder for your Claude Code skills.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
.github/scripts/check_versions.py:106 result = subprocess.run(Skills Marketplace (Plugin)
Compatibility: Not stated.
Centrale catalogus van AI-assistant plugins voor de Nederlandse Overheid
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:21 prepareSkolverket MCP (MCP server)
Compatibility: Not stated.
<img width="700" height="220" alt="Skolverket MCP logo" src="https://github.com/user-attachments/assets/74563bdb-eea4-4276-a58c-ec89b11806ed" />
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:23 prepareSkylight Mcp (MCP server)
Compatibility: Not stated.
An MCP (Model Context Protocol) server for the Skylight Calendar API.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skills/slideops/references/automation.md:49 curl -o tools/slideops-check.py \slideops (Skill)
Compatibility: Not stated.
Turn a repository into a slide deck or Markdown docs, then find out the day they stop matching the code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
actions/publish/publish.sh:24 curl --fail --silent --show-error --location "$SLIDESFLY_CLI_URL" --output "$cliSlidesfly Integrations (Skill)
Compatibility: Not stated.
Public, reproducible integration assets for [Slidesfly](https://slidesfly.com), the publishing layer for existing HTML presentations.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
package.json:44 prepareSnapshot Site (MCP server)
Compatibility: Not stated.
Official MCP server for the Snapshot Site API
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/c2pa_sign.py:310 shutil.rmtree(dev_tmpdir, ignore_errors=True)socialforge (Plugin)
Compatibility: Portable across standard formats.
An open-source social media production system that turns a content calendar into on-brand copy, images, video, and client-ready delivery - with compliance and human approval built in.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES
skills/luna-default-agents/scripts/deploy_luna_defaults.py:24 proc = subprocess.run(Sol Luna Orchestrator (Plugin)
Compatibility: Not stated.
Version 1.9 changes the workflow from a project-wide automatic reviewer gate to an **explicit Skill-scoped gate**.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.gitignore:28 id_rsa*Solution Ai Connect (Plugin)
Compatibility: Not stated.
Solution AI Connect bundle with SolAI knowledge and SolAI CLI skills for Claude and local coding agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
internal/sondar/sources.go:43 cmd := exec.CommandContext(ctx, command, args...)sondar (Skill)
Compatibility: Not stated.
Use whenever the user asks to monitor AI builder signals, GitHub AI projects, model/app launch opportunities, hot keywords, PMF signals, commercial trend detection, or daily AI radar workflows.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/commands/shared.ts:71 /^(?:\.env(?:\.(?!example$).*)?|\.envrc|\.npmrc|\.Soujo (Plugin)
Compatibility: Not stated.
Resumable spec → plan → layer workflow shared by Claude Code and Codex
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
src/core/diagrams.ts:21 const request = requests.get(id);sourcey (MCP server)
Compatibility: Not stated.
Precision documentation from OpenAPI, MCP, Doxygen, and Markdown guides.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:7 prepareSp500 Mcp Server (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/readme-poster.png" alt="S&P 500 MCP promotional poster" width="100%" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
scripts/generate_star_history.py:15 res = subprocess.run(cmd, capture_output=True, text=True)Speak Human Tw (Skill)
Compatibility: Not stated.
「說人話」：繁體中文的去 AI 味改寫 skill。抓 38 種 AI 寫作痕跡，順手校正中國用語與半形標點，給 Claude Code / Codex / Cursor 用。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
scripts/check-package.py:65 ".ds_store", "thumbs.db", ".env", "id_rsa", "id_ed25519",Specforge Ai Skill (Skill)
Compatibility: Not stated.
>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_UNCONFIRMED
.github/workflows/speckit-init.yml:131 paths = subprocess.check_output(Speckit Agent Skills (Skill)
Compatibility: Not stated.
Agent skills and generated runtime entry points for [Spec Kit](https://github.com/github/spec-kit).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
demo-v5.mjs:18 fs.rmSync(root + "/.speclock", { recursive: true, force: true });speclock (Plugin)
Compatibility: Portable across standard formats.
Action guardrails for AI coding agents , native Claude Code enforcement, MCP integrations, and Git/CI checks.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED +1 more
package.json:53 preparespecmate (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
src/utils/gitClone.ts:229 for (const entry of await fs.readdir(target)) await fs.rm(join(target, entry), { recSpecPilot (MCP server)
Compatibility: Not stated.
SpecPilot is a spec-driven development (SDD) CLI for AI coding agents like Claude Code, Cursor, and ChatGPT.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_UNCONFIRMED +1 more
index.js:116 const res = await fetch(url, { ...opts, signal: ctrl.signal, heaSpecularis AI Visibility Audit (MCP server)
Compatibility: Not stated.
Run a free AI visibility (GEO/AEO) audit on any website from inside Claude, ChatGPT, or any MCP client , checks whether ChatGPT, Claude & Perplexity can find and cite it, with an instant snapshot and an optional full scored PDF report.
This grade is a hygiene screen, not proof of safety.
