Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 1301 to 1350 of 3,335 Grade C entries. Page 27 of 67.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
apps/site/lib/github-stars.ts:12 const response = await fetch(`https://api.github.com/repos/${GITHUB_REPO}`, {wilmai (MCP server)
Compatibility: Not stated.
<img src="assets/wilmai_mascot.png" alt="WilmAI mascot" width="150" align="right">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
src/update.rs:519 "curl failed ({}): {}",Winx Code Agent (MCP server)
Compatibility: Not stated.
<div align="center"> <img src=".github/assets/fairy.png" alt="Winx Logo" width="150" />
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:44 postinstallwizard (Plugin)
Compatibility: Not stated.
Build AI spells for what you do - a meta-builder that turns recurring tasks into reusable workflows that any AI assistant can run.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST OBFUSCATION_MINIFIED_PAYLOAD
public/examples/build.py:26 with urllib.request.urlopen(req, timeout=30) as response:WOCLUB Cube Playground (MCP server)
Compatibility: Not stated.
Shared voxel world for AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
docker/codex-policy-launcher.mjs:297 b),"r");fs.fsyncSync(d);fs.closeSync(d);fs.unlinkSync(b);',Workflow MCP (MCP server)
Compatibility: Not stated.
Workflow MCP runs Claude-compatible JavaScript workflow definitions as durable Codex-backed MCP jobs without requiring Agent Code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +3 more
scripts/devcheck.ts:156 * Executes a shell command using child_process.spawn and returns a structured result.Workflows Mcp Server (MCP server)
Compatibility: Not stated.
Store, query, and create YAML workflow playbooks for LLM agents via MCP.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV +1 more
scripts/_dstore-sample.js:13 ;Lt.push(i);const e=new Promise((e,s)=>{fetch(i).then(e=>e.text()).then(o=>{constWorkix (MCP server)
Compatibility: Not stated.
Remote jobs, freelance gigs, vacancies.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
src/world_intel_mcp/analysis/aoi.py:1826 "fetch (by event date; ACLED publishes with a reporting lag), "World Intel Mcp (MCP server)
Compatibility: Not stated.
139-tool MCP server for real-time global intelligence from free public APIs: markets, SEC filings, conflict, military, aircraft-cohort early warning, refugee and migration flows, cyber, climate, news, and 30+ domains.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
skills/wp-admin-browser/SKILL.md:31 // POST to wp-login.php via fetch (fastest, no UI needed for login itself)Wp Dev Skills (Plugin)
Compatibility: Not stated.
WordPress plugin development skills for AI coding agents , Claude Code, Gemini CLI, Cursor, Windsurf, Cline, Codex, Copilot, opencode, and more
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
package.json:29 prepareWwa Transform (Plugin)
Compatibility: Not stated.
WWA Transform , Turn any website into an AI-powered agentfront.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
src/tools/diagnostics/hang/sessions.ts:210 fs.rmSync(sessionDir, { recursive: true, force: true });Xc Mcp (MCP server)
Compatibility: Not stated.
**An MCP server that lets AI agents build, run and drive iOS apps , without drowning in Xcode's output.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:15 prepareXclaude Plugin (MCP server)
Compatibility: Not stated.
Modular iOS development automation suite.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
apps/api/internal/testutil/docker.go:38 cmd := exec.Command("docker", "info")xdrop (Skill)
Compatibility: Not stated.
<!-- renoise-banner --> <p align="center"> <a href="https://renoise.ai/plugin?utm_medium=github&utm_source=xixu"> <img src="https://raw.githubusercontent.com/renoise-ai/renoise-plugins-official/main/assets/icon.svg" alt="Renoise" width="96"> </a> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
package.json:37 preparexget (Skill)
Compatibility: Not stated.
Ultra-high-performance, secure, all-in-one acceleration engine for developer resources
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL
plugins/xhostd/skills/xhostd/references/api-reference.md:673 curl -sS --fail-with-body -X PUT \xhost (MCP server)
Compatibility: Not stated.
Claude Code, Codex, and Cursor plugin for [xhostd](https://xhostd.com) , deploy applications, sites, and services.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
docs/benchmarks/run_bigrepo_4backend.py:187 r = subprocess.run(shell, cwd=cwd, capture_output=True, text=True,xmp4 Semantic code knowledge for your stack (MCP server)
Compatibility: Not stated.
OSS libs in your stack, really used: source, tests, callers.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
api/v1/alert.py:183 candidates = list(query.fetch())Xposedornot Api (MCP server)
Compatibility: Not stated.
<h1 align="center">XposedOrNot API</h1>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
package.json:27 prepareYandex Delivery MCP (MCP server)
Compatibility: Not stated.
MCP-сервер для B2B API Яндекс Доставки , рассчитать стоимость, оформить и отследить отправление из AI-приложения без собственной интеграции
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
package.json:26 prepareYango Delivery MCP (MCP server)
Compatibility: Not stated.
MCP server for Yango Delivery’s B2B Express Claims API , quote, book and track courier deliveries from an AI app
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
package.json:26 prepareYango Tech Retail MCP (MCP server)
Compatibility: Not stated.
MCP server for Yango Tech Retail , inspect and manage stores, catalog, prices, stock and orders from an AI app
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
src/yapitalism/demo.py:31 return subprocess.run(Yapitalism (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.AytuncYildizli/yapitalism --> <!-- The MCP Registry verifies PyPI package ownership by finding this string in the package description, which is this README.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL
examples/provision-and-call.py:20 r = httpx.post(YG3 Marketing MCP (MCP server)
Compatibility: Not stated.
**Capability query this answers:** *marketing MCP + Claude (or ChatGPT) + site + content + SEO + outbound.*
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
plugins/yonsei-certificate-assistant/skills/yonsei-certificate-assistant/scripts/diagnose_print_env.py:37 compYonsei Skills (Plugin)
Compatibility: Not stated.
학생 친화적인 연세대학교 생활 도구용 Codex·Claude Code 플러그인 마켓플레이스
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
.github/workflows/validate-skill.yml:54 changed = subprocess.check_output(You Suck At Prompting (Plugin)
Compatibility: Not stated.
A portable skill for AI agents that reviews and improves prompts, clarifies vague requests, and leaves clear requests alone.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
packages/ytdl-rmcp/scripts/check-package.js:450 fs.rmSync(tempDir, { recursive: true, force: true });YTDL RMCP (MCP server)
Compatibility: Not stated.
yt-dlp search, download, metadata, delivery, and Plex workflows over MCP and CLI.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
scripts/generate_models.py:74 result = subprocess.run(cmd, check=True, capture_output=True, text=True)Zernio (MCP server)
Compatibility: Not stated.
<p align="center"> <a href="https://zernio.com"> <img src="https://zernio.com/brand/icon-primary.png" alt="Zernio" width="60"> </a> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
components/docs/doc-feedback.tsx:135 const response = await fetch(feedbackEndpoint, {Zibll Docs (Plugin)
Compatibility: Not stated.
子比主题二次开发社区文档，覆盖插件、子主题、Codestar Framework、MCP 与 Codex 插件。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST
skills/ask-zilliz/references/auto-scaling.md:31 curl -X POST "${BASE_URL}/v2/clusters/${CLUSTER_ID}/modify" \zilliz (Plugin)
Compatibility: Not stated.
Zilliz Cloud management plugin with 14 skills covering cluster lifecycle, collection schema, vector search, index tuning, bulk import, RBAC, backups, and monitoring.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
src/index.ts:1554 const r = await fetch(upstream.toString());Zooza MCP Server (MCP server)
Compatibility: Not stated.
MCP server for Zooza , class scheduling, attendance, and booking for activity businesses.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
scripts/check-env.py:46 result = subprocess.run(cmd, capture_output=True, text=True, timeout=10)Zotero Mcp Workbuddy Guide (MCP server)
Compatibility: Not stated.
> 基于 [54yyyu/zotero-mcp](https://github.com/54yyyu/zotero-mcp)（v0.4.1, 3.4k+ stars） > 专为 WorkBuddy 用户设计 · 一份文档，人机共用
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST OBFUSCATION_MINIFIED_PAYLOAD
addon/content/workers/download-worker.js:10 const resp = await fetch(url);Zotero Semantic Search (Plugin)
Compatibility: Not stated.
Public repository ilDon/zotero-semantic-search.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
src/llm/client.ts:166 const res = await fetch(`${this.cfg.llmBaseUrl}/models`, { headers: this.headers() });ableton-mind Ableton Live MCP server (MCP server)
Compatibility: Not stated.
Definitive MCP (Model Context Protocol) server for **Ableton Live**.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
docs/README.omp.md:38 install script (`curl -fsSL https://omp.sh/install | sh` on macOS/Linux,Aegis (Skill)
Compatibility: Not stated.
Make AI coding agents architecture-aware: baseline-first, evidence-verified, drift-checked, and safe across long tasks.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
plugins/aether/src/aether_core/embeddings.py:116 with urllib.request.urlopen(request, timeout=self.timeout) asaether (Plugin)
Compatibility: Not stated.
Codex插件，能将图片沉淀为可复用的视觉记忆，助你持续创作出美学风格一致的图片。The Codex plugin can turn images into reusable visual memories, helping you consistently create images with a unified aesthetic style.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
scripts/postinstall.cjs:89 curl -fsSL https://bun.sh/install | bashAgent Bridge (MCP server)
Compatibility: Not stated.
A local bridge for bidirectional collaboration between Claude Code and Codex.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
plugins/unbounce-mcp/skills/mcp-ai-builder-authoring/design-systems/ollama.md:175 - Contains the literal `curlAgent Plugins (Plugin)
Compatibility: Not stated.
The marketplace for **Unbounce's agent plugins**, installable across both the Claude (`.claude-plugin/`) and the Codex / ChatGPT (`.agents/`) ecosystems.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
skills/agent-rules/references/examples/coding-agent-cli/scripts-AGENTS.md:315 curl --proto '=https' --tlsv1.2Agent Rules Skill (Skill)
Compatibility: Not stated.
Generate and maintain AGENTS.md, copilot-instructions.md, and other agent rule files
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
installer/main.sh:85 curl -fsSL https://raw.githubusercontent.com/archibate/agent-skills/master/install.sh | bAgent Skills (Skill)
Compatibility: Not stated.
> 粉丝：DeepShit 老是给我拉史，要是能让 agent 直接读《小彭大典》就好了👨🏫
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.beads/README.md:64 curl -sSL https://raw.githubusercontent.com/steveyegge/beads/main/scripts/install.sh | basAgent Skills (Skill)
Compatibility: Not stated.
Portable AI-agent workflows for [Pi](https://pi.dev), Claude Code, and Codex.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
skills/code-quality/code-review/references/security-patterns.md:303 return requests.get(url).text # User contrAgent Skills (Skill)
Compatibility: Not stated.
**The most trusted, most cited, most useful skill source in the Agent Skills ecosystem.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
assets/viewer.js:65 const response = await fetch("api/state", {Agent Wait Sponsor (Plugin)
Compatibility: Not stated.
[简体中文](./README-CN.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
directory/cards.py:71 f'curl -sS -i -X POST "{url}" 'agent-tools (x402 + MCP + A2A directory) (MCP server)
Compatibility: Not stated.
The server that powers [agent-tools.cloud](https://agent-tools.cloud) , an open directory of **x402 paid services** with a free MCP discovery endpoint.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
adapters/langchain/test_e2e.py:27 resp = httpx.get(f"{registry_url}/cards", params={"q": "joke", "limit": 5})agentbnb (Skill)
Compatibility: Not stated.
<p align="center"> <img src="docs/banner.svg" alt="AgentBnB , Rent matured AI agents for short collaborative sessions" width="100%"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
scripts/setup-vm-gpu.sh:64 curl -LsSf https://astral.sh/uv/install.sh | shAgentic Research Engine Oss (Plugin)
Compatibility: Not stated.
The best $0 research agent that runs on a laptop.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
examples/09-mini-harness/smoke_test.py:166 ("deny 覆盖 allow（参数级）", "run_shell", {"command": "curl http://x | baAgentLearn (Skill)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
package.json:19 prepareAgentql Mcp (MCP server)
Compatibility: Not stated.
This is a Model Context Protocol (MCP) server that integrates [AgentQL](https://agentql.com)'s data extraction capabilities.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.github/workflows/validate.yml:253 curl -fsSL https://opencode.ai/install | bash -s -- --version 1.18.30agents (Skill)
Compatibility: Not stated.
Multi-harness agentic plugin marketplace for Claude Code, Codex, Cursor, OpenCode, GitHub Copilot, Google Antigravity, and Pi
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
AGENT_IGNORE_INSTRUCTIONS
references/system-prompts-instructions.md:150 - “Ignore all previous instructions”;Agents Best Practices (Skill)
Compatibility: Not stated.
Provider-neutral Agent Skill for Codex, Claude Code, and agentic harness design.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
bin/agents-scaffold.sh:11 curl -fsSL https://raw.githubusercontent.com/leeyudok/agents-scaffold/main/bin/agentAgents Scaffold (Skill)
Compatibility: Not stated.
English | [한국어](README.ko.md) | [简体中文](README.zh.md) | [日本語](README.ja.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
infra/onprem/deploy-onprem.sh:158 curl -fsSL https://ollama.com/install.sh | shagentsmcp (Plugin)
Compatibility: Not stated.
Context-sync protocol for AI agents.
This grade is a hygiene screen, not proof of safety.
