Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 1201 to 1250 of 3,335 Grade C entries. Page 25 of 67.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST +1 more
src/spotify_scraper/browser/login.py:128 shutil.rmtree(user_data_dir, ignore_errors=True)SpotifyScraper (MCP server)
Compatibility: Not stated.
Extract public Spotify data , tracks, albums, artists, playlists, podcasts & lyrics , without the official API.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zEwnTiPa0" style="display:none">c+Gx54mx1WZO539uWuJLO7fg4xOoUZV79D9ieT/smzBF/L3ti6GSHBeqSqlitedata Extensions Playbook (Plugin)
Compatibility: Not stated.
---
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
cmd/ssh-mcp/install.go:63 cmd.Flags().String("ssh-config", "", "Path to SSH config file (default: ~/.ssh/confiSsh Mcp (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="./assets/readme/hero.gif" width="100%" alt="ssh-mcp: an MCP server that gives AI assistants secure, scoped SSH access to remote servers.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
cli/internal/channel/channel.go:374 cmd := exec.CommandContext(ctx, "git", append(base, args...)...)Stackcord (Plugin)
Compatibility: Not stated.
Question-driven full-stack collaboration harness for Codex with durable context, Git/submodule coordination, semantic conflict checks, and release continuity.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
scripts/verify-deploy.sh:23 CURL=(curl -s --max-time 90)Star Wars MCP (MCP server)
Compatibility: Not stated.
Star Wars API (SWAPI) as a remote MCP server: films, people, planets, species, starships, vehicles.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST
src/stata_cli/daemon.py:362 subprocess.Popen(Stata Cli (Skill)
Compatibility: Not stated.
>-
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
package.json:35 prepareStitchAPI Docs (MCP server)
Compatibility: Not stated.
<p align="center"> <a href="https://stand-with-ukraine.pp.ua"><img alt="Stand With Ukraine" src="https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/banner2-direct.svg" /></a> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
plugins/stock-industry-chain/skills/stock-industry-chain/scripts/build.py:62 out = subprocess.run(Stock Industry Chain (Plugin)
Compatibility: Not stated.
> 对 Claude Code 说一句「分析 XX 的产业链」，立刻得到一张**可点击的产业链图谱**, , 上下游公司按环节排好，点任意公司弹出资料卡，还能看它的**实时 K 线**。 > > **A股 / 港股 / 美股都支持。零 API key、零成本。**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
scripts/build-release.cjs:18 fs.rmSync(target, { recursive: true, force: true });Stop That Shit (Plugin)
Compatibility: Portable across standard formats.
Stop That Shit（别再造史了）｜面向 Codex/GPT 场景的多平台 Hook + Skill Guard：拦截 AI coding agent 无需求的哈希、校验和与任务范围膨胀。 A multi-platform Hook + Skill Guard for AI coding agents in Codex/GPT workflows: stop unrequested hashes, checksums, and task-scope creep.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
.github/scripts/triage_issue.py:127 return subprocess.run(cmd, check=check, text=True, **kwargs)Stretch Ai Yoga (Skill)
Compatibility: Not stated.
Cognitive training practices for AI agents , short, self-applied exercises that develop attention, calibration, deliberation, ambiguity tolerance, multi-objective stability, and memory consolidation.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
README.md:156 - **Configuration**: Set `OPENAI_API_KEY` environment variable or use the profile's `.env` fileStructify Dev Flow (Plugin)
Compatibility: Not stated.
Plan Build Run 2026: Ultimate Claude Code Plugin for Structured Agent Development
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES SECRETS_PATH_DOTENV
skills/media-producer/scripts/optional-guidance.test.mjs:22 await fs.rm(guideRoot, { recursive: true });Studio Skills (Plugin)
Compatibility: Not stated.
Claude Code plugin library for filmmaking skills.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
src/session/SessionManager.ts:302 await fs.unlink(filePath)Sub Agents Mcp (MCP server)
Compatibility: Not stated.
Run reusable coding agents from any MCP-compatible client.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
package.json:24 prepareSubio Mcp (MCP server)
Compatibility: Not stated.
Scrape public posts from X, LinkedIn, Hacker News and Reddit in a local browser that is never signed in.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
src/api/substack/image.spec.js:63 await fs.rm(dir, {recursive: true, force: true});Substack Mcp (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) Server for [Substack](https://substack.com) enabling LLM clients to interact with Substack's API for automations like creating posts, managing drafts, and more.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_UNCONFIRMED OBFUSCATION_ENCODED_BLOB
playground/index.ts:16 headers: process.env.KRATOS_API_KEYsufetch (MCP server)
Compatibility: Not stated.
<p> <a href="https://www.npmjs.com/package/sufetch"><img src="https://img.shields.io/npm/v/sufetch.svg?style=flat&colorA=18181B&colorB=28CF8D" alt="Version"></a> <a href="https://www.npmjs.com/package/sufetch"><img src="https://img.shields.io/npm/dm/sufetch.svg?style=flat&colorA=
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
scripts/open_catalog_resync.py:154 result = subprocess.run(Sugra API (MCP server)
Compatibility: Not stated.
Gateway between LLM agents and world data through eight tools and a bundled endpoint catalog.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
bin/install.js:215 fs.rmSync(rt, { recursive: true, force: true });Supercmo Skills (MCP server)
Compatibility: Not stated.
Open, model-agnostic, BYO-keys marketing skills for AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
plugins/supergraph/team/worktree.js:356 fs.rmSync(nmDst, { recursive: false, force: true })supergraph (Plugin)
Compatibility: Not stated.
Engineering workflow system for AI coding agents , mandatory planning, TDD, verification, review, and intelligent codebase graph analysis.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
skills/brainstorming/scripts/server.cjs:604 if (fs.existsSync(eventsFile)) fs.unlinkSync(eventsFile);Superpowers Zh (Skill)
Compatibility: Not stated.
🦸 AI 编程超能力 · 中文增强版 , superpowers（250k+ ⭐）完整汉化 + 4 个中国原创 skills，让 Claude Code / Copilot CLI / Hermes Agent / Cursor / Windsurf / Kiro / Gemini CLI / Qoder 等 26 款 AI 编程工具真正会干活
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zkaS7KXO0" style="display:none">ZCw/B+wFlX4pdxsjd/wjdzeG7rbFdEtXKGk0X7TAqxpSMTMN7hXSBHA6Supremeworkflow Orchestrator (Plugin)
Compatibility: Not stated.
Superpowers Security Ops 2026: OWASP Workflow Routing & Auto-Fix Red Team Engine
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
agents/README.md:19 curl -o .claude/agents/sverklo-explore.md \sverklo (MCP server)
Compatibility: Not stated.
<p align="left"> <img src="./docs/logo.svg" alt="sverklo" width="280" height="79"/> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB
skills/ios-ettrace-performance/scripts/collect_dsyms.py:27 result = subprocess.run(Swift Ios Skills (Skill)
Compatibility: Not stated.
Agent Skills for iOS 26+, Swift 6.3, SwiftUI, and modern Apple frameworks
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zvKVmvFT0" style="display:none">qMDdGf2mhPegycIRN0NV02u/8NOs4PGaOzkJ9riy4VGe3dET/7bDjfmESwift Uikit Components (Plugin)
Compatibility: Not stated.
Swift-UIKit-Pro 2026: Build Production-Ready Programmatic iOS Apps with Advanced Architecture & Data Flow Patterns
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
hooks/lib.js:328 if (now - fs.statSync(p).mtimeMs >= ttlMs) fs.unlinkSync(p);Symvanta (MCP server)
Compatibility: Not stated.
Connects the Symvanta code-graph MCP server and steers agents to its tools instead of shell search: the MCP connection, a SessionStart context primer, a skill, slash commands, read-only subagents, and a family of non-blocking augmenters on Grep/Glob, Bash code searches (grep/rg/g
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL
release.sh:565 if command -v curl >/dev/null 2>&1; thenTailscale Mcp (MCP server)
Compatibility: Not stated.
One click adds this to your local Yaw MCP config so it's available in every Yaw Terminal session.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED INSTALL_UNPINNED SECRETS_PATH_DOTENV
mcp/server.py:359 completed = subprocess.run(Takeoff Lens Plugin (Plugin)
Compatibility: Not stated.
AI Plugin (MCP+Skill) drawing intelligence for reviewed, traceable quantity takeoff from engineering PDFs.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
plugins/tale-mode/hooks/approve-readonly.sh:81 (*.ssh*|*id_rsa*|*id_ed25519*|*.pem*|*.key*|*.pass*|*secret*|*cTale Mode (Skill)
Compatibility: Not stated.
> **Anthropic pulled the plug on Fable.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:27 prepareTam Mcp Server (MCP server)
Compatibility: Not stated.
A Model Context Protocol server providing market research and business analysis capabilities through 28 tools, 15 business prompts, and integration with 8 economic data sources.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES INSTALL_UNPINNED +1 more
examples/chrome_youtube_demo.py:50 subprocess.Popen(args)Tarsier (MCP server)
Compatibility: Not stated.
<div align="center"> <h1>🐒 Tarsier-AI</h1> <p><b>Accessibility Trees as a Portable Semantic Representation for Agentic GUI Control</b></p> <p><i>The "Playwright" for Cross-Platform Desktop & Web Apps.</i></p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_UNCONFIRMED
package.json:16 prepareTavily MCP Server (MCP server)
Compatibility: Not stated.
The Model Context Protocol (MCP) is an open standard that enables AI systems to interact seamlessly with various data sources and tools, facilitating secure, two-way connections.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_MINIFIED_PAYLOAD
site/index.html:152 const r = await fetch(s.src);techne (Skill)
Compatibility: Not stated.
A curated skills plugin for practical AI-era craft, judgment, and delivery.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
README.md:212 3. **Set your API keys** in a `.env` file (template provided)Technical Founding Gtm Toolkit (Plugin)
Compatibility: Not stated.
The Complete AI & Technical Founder GTM Toolkit 2026 , Pricing, PLG & Enterprise Sales
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
src/tg_business_bridge/config.py:50 res = subprocess.run(Telegram Business Bridge (MCP server)
Compatibility: Not stated.
**Connect any AI agent to your personal Telegram messages , through the official Telegram Business API.** No userbot, no MTProto session, no risk of losing your account.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zAtxHezq0" style="display:none">BvtL324C4QYb8XOYvZ557Q560dcr4j5QTlFYFJ2AlbUw5kfVbBKmfEK8Temporal Canvas (Plugin)
Compatibility: Not stated.
---
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
client.mjs:585 const response = await fetch(origin + path, {TERM (MCP server)
Compatibility: Not stated.
A forum whose members are AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
backup/disaster-recovery/SKILL.md:176 curl -s http://localhost/healthTerminal Skills (Skill)
Compatibility: Not stated.
<p align="center"> <img src="https://img.shields.io/badge/Claude-Skills-blueviolet?style=for-the-badge&logo=anthropic" alt="Claude Skills"> <img src="https://img.shields.io/badge/Terminal-Focused-green?style=for-the-badge&logo=gnometerminal" alt="Terminal"> <img src="https://img.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
terminal_server.py:23 result = subprocess.run(command, shell=True, cwd=DEFAULT_WORKSPACE, capture_output=True,terminal_server (MCP server)
Compatibility: Not stated.
Welcome to **The AI Language** project!
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
requirements.txt:1 fastapi>=0.128,<1TestGraph (MCP server)
Compatibility: Not stated.
**TestGraph is an experimental shared knowledge and experience graph for AI assistants.** It lets independent AI clients contribute to the same graph while preserving the original human evidence, model attribution, disagreement, confidence and the path by which a conclusion was r
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zDyMlybZ0" style="display:none">gs8mjkOlpHpF4Rx25huv87V40Kr4E6UN6YFj5VDCNv+00iqEQbXjABysText Metrics Analyzer (Plugin)
Compatibility: Not stated.
TextForge AI is a powerful pretext plugin and knowledge layer that equips Claude, GPT-4, and other large language models with deep, DOM-free text measurement, layout intelligence, and precise spatial reasoning.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
src/text_to_speech_mcp/runner.py:111 subprocess.run(Text to Speech (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.Engr-FaizanAli/text-to-speech -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES INSTALL_UNPINNED +2 more
build.py:70 result = subprocess.run(cmd, check=True, **kwargs)The Librarian (Plugin)
Compatibility: Not stated.
Stop re-explaining your project every session.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
install.py:262 done = subprocess.run(Thesis Proposal Skills (Skill)
Compatibility: Not stated.
Write a convincing Bachelor's or Master's thesis proposal with the help of an AI agent, in English or German.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/audit_live.sh:55 INIT=$(curl -sf --max-time 10 \ThinkNEO Control Plane (MCP server)
Compatibility: Not stated.
Enterprise AI Control Plane: governance, guardrails, spend tracking, compliance & smart routing.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
plugins/threadex/scripts/validate_threadex.py:81 result = subprocess.run(threadex (Plugin)
Compatibility: Not stated.
Lightweight Codex plugin for turning ambiguous requests into reviewable /goal-ready workflows.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="ziuZPyGE0" style="display:none">KD65ixA0RHl8BDytGglrmWYx8O5E5S12ufiRgbA/KqceI7WBEiQDAyVJTicktick Terminal Control (Plugin)
Compatibility: Not stated.
Most task management tools treat your workflow like a filing cabinet, rigid, linear, and disconnected from the chaos of real life.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
README.md:35 curl -fsSL https://tinystruct.org/create | shtinystruct (MCP server)
Compatibility: Not stated.
A lightweight, modular Java application framework for web and CLI development, designed for AI integration and plugin-based architecture.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/cert_helper.py:187 proc = subprocess.run(TLS Radar (MCP server)
Compatibility: Not stated.
SSL/TLS certificate monitoring and free Let's Encrypt issuance inside Claude Code and Cowork, through a single MCP server.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
benchmarks/longmemeval/src/tmcra_benchmark/harness/evaluate_qa_official_judge.py:143 with urllib.request.urlopTmcra Memory (Plugin)
Compatibility: Not stated.
TMCRA Core , local-first, scope-isolated long-term memory runtime for AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
skills/null-epoch/SKILL.md:104 curl -s -H "Authorization: Bearer $NE_API_KEY" \Tne Sdk (Skill)
Compatibility: Not stated.
<p align="center"> <strong>TNE-SDK</strong><br> <em>The official Python SDK for <a href="https://null.firespawn.ai">The Null Epoch</a></em> </p>
This grade is a hygiene screen, not proof of safety.
