Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 151 to 200 of 3,335 Grade C entries. Page 4 of 67.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
apps/docs/providers/grok.md:50 curl -fsSL https://x.ai/cli/install.sh | bashAsk Llm (Plugin)
Compatibility: Not stated.
MCP server for AI-to-AI collaboration , bridge Claude with Gemini, Codex, and other LLMs for code review, second opinions, and plan debate
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/dependencies.mjs:191 try { fs.unlinkSync(destination); } catch { /* best effort cleanup */ }astack (Plugin)
Compatibility: Not stated.
Evidence-first engineering: a six-command Cursor plugin and a portable Agent Skill.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_DOTENV OBFUSCATION_MINIFIED_PAYLOAD
plugins/astra-orchestrator/scripts/install-native.mjs:61 try{await fs.writeFile(temp,o.content,{flag:'wx'});awAstra Orchestrator (Plugin)
Compatibility: Not stated.
Astra plans and reviews; Luna implements.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED
package.json:41 prepareatelier (Skill)
Compatibility: Not stated.
> A personal development toolkit for AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +3 more
simulate_users.py:1207 shutil.rmtree(TEMP_DIR, ignore_errors=True)attestix (MCP server)
Compatibility: Not stated.
AI agent identity, signed credentials, delegated authority and portable governance evidence.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
plugins/audio-transcriber/skills/audio-transcribe/SKILL.md:166 # Bedrock (uses AWS credential chain: IAM role,Audio Transcriber (Plugin)
Compatibility: Not stated.
Agent skill for multi-speaker meeting & podcast transcription , FunASR (Paraformer/SenseVoice/Whisper) + MiMo-V2.5-ASR + CAM++ speaker diarization + LLM cleanup.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
src/store.ts:477 fs.unlinkSync(file)Auth Codex Plugin (Plugin)
Compatibility: Codex.
Auth codex plugin for opencode with local dashboard, force mode, and etc.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
src/revit_mcp_server/agent_bridge.py:68 # subprocess.run (no shell) resolves a bare name via CreateProcess, whAutodesk Revit MCP Server (MCP server)
Compatibility: Not stated.
Python MCP server for reviewing BIM model quality and fixing Revit parameters with Claude, Codex and other MCP clients.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.gitignore:47 id_rsaAutodl Remote (Plugin)
Compatibility: Not stated.
Codex App plugin for local code editing, SSH-based AutoDL remote GPU execution, and explicit file upload/download.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES OBFUSCATION_ENCODED_BLOB
src/autoharness/hook/dispatch.py:83 subprocess.Popen( # host-detach: fire-and-forget so the Stop hook returnsautoharness (Skill)
Compatibility: Not stated.
Autoharness , a self-learning skill layer for Claude Code , distills skills from your real sessions, updates them as you work, and prunes the ones that stop getting used.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zEMiQzER0" style="display:none">jvb2fnwBuxV8w65C7xEk5AYSr9fmBdCof2VP+TMgzVm46/p0fhH8byWOAutomated Application Pipeline (Plugin)
Compatibility: Not stated.
---
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
examples/02-unshaped-magic-adventure/sol-high/benchmark/verify_benchmark.py:141 ngram_run = subprocess.run(Autonovel Agent Skills (Skill)
Compatibility: Not stated.
`autonovel-agent-skills` is a multi-skill fiction pipeline maintained by [DukeTwoCan](https://github.com/DukeTwoCan).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
skills/avenox-thumbnail/references/logo-library.md:20 curl -sL "https://cdn.simpleicons.org/<slug>/<HEX>" -o <avenoxskills (Skill)
Compatibility: Not stated.
Agent skills built and battle-tested in production by [Avenox](https://avenox.lol).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED OBFUSCATION_MINIFIED_PAYLOAD
scripts/update_rankings.py:719 with urllib.request.urlopen(request, timeout=30) as response:Awesome Academic Research Skills (Skill)
Compatibility: Not stated.
> 面向中文用户的学术论文与科研 Agent Skill 每日排行榜。自动搜索、过滤并排名 GitHub 上与论文写作、文献综述、深度研究、评审反馈、实验复现相关的 Skill / Agent / Workflow 仓库。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/update_metadata.py:45 with urllib.request.urlopen(req, timeout=30) as resp:Awesome Academic Skills (Skill)
Compatibility: Not stated.
<div align="right">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
skills/awesome-code-standards/SKILL.md:109 const response = await fetch(url);Awesome Agent Skills (Skill)
Compatibility: Not stated.
Skills for AI coding agents: code review, test writing, design docs, debugging, security and dependency audits, git history surgery, refactoring, copywriting, and cleaning up AI-written code and text.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_UNCONFIRMED
.github/workflows/hygiene.yml:38 files = subprocess.run(Awesome Agentic Engineering (Skill)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
scripts/check_readme.py:150 result = subprocess.run(["gh", "auth", "token"], capture_output=True, text=True, cAwesome Ai Pentesting (MCP server)
Compatibility: Not stated.
> A curated list of AI-powered tools, frameworks, and resources for penetration testing, bug bounty hunting, red teaming, and cybersecurity operations.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
document-skills/docx/ooxml/scripts/pack.py:103 result = subprocess.run(Awesome Claude Skills (Skill)
Compatibility: Not stated.
A curated list of awesome Claude Skills, resources, and tools for customizing Claude AI workflows
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
skills/alphaear-signal-tracker/scripts/utils/md_to_html.py:147 <p>Generated by AlphaEar @ {os.popen('date').reAwesome Finance Skills (Skill)
Compatibility: Not stated.
A collection of Awesome Finance Agent Skills for free and easy to start | 一系列开源免费的金融分析Agent Skills
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
docs/app.js:740 fetch("examples.json"),Awesome Goal Prompts (Skill)
Compatibility: Not stated.
When Claude Code, Codex, Cursor, or another coding agent starts making broad edits, paste a contract that says exactly what to inspect, what not to touch, how to verify, and when to stop.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
scripts/auto_add_skills.py:32 result = subprocess.run(["gh", *args], capture_output=True, text=True)Awesome Human Distillation (Skill)
Compatibility: Not stated.
A curated catalog of human distillliation agent skills
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB
package.json:7 prepareAwesome Mcp Servers (MCP server)
Compatibility: Not stated.
**A hand-curated, link-checked catalog of [Model Context Protocol (MCP)](https://modelcontextprotocol.io) servers, with a [searchable directory](https://mcphq.org/) and a [JSON API](#use-the-data).**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:44 prepareAwesome Mineflayer MCP (MCP server)
Compatibility: Not stated.
A production-ready [Model Context Protocol](https://modelcontextprotocol.io) server that gives an LLM agent **standalone-equivalent control** over a [Mineflayer](https://github.com/PrismarineJS/mineflayer) Minecraft bot , movement, mining, crafting, inventory, combat, containers
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
cloudphone-adb-tunnel/SKILL.md:54 curl -fsSL <你的脚本URL> -o ~/install-termux.sh && bash ~/install-termux.shAwesome Skills (Skill)
Compatibility: Not stated.
Independent Agent Skills packaged according to the Anthropic Agent Skills specification.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED OBFUSCATION_ENCODED_BLOB
skills/security-webshells/references/Web-Shells/WordPress/plugin-shell.php:70 passthru($command , $return_var)Awesome Skills Security (Skill)
Compatibility: Not stated.
Security testing toolkit for AI Agent: curated SecLists wordlists, injection payloads, and expert agents for authorized pentesting, CTFs, and bug bounties
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
README.md:79 # Set up your credentials in ~/.aws/credentials and ~/.aws/configAws Cost Explorer Mcp Server (MCP server)
Compatibility: Not stated.
An MCP server for getting AWS spend data via Cost Explorer and Amazon Bedrock usage data via [`Model invocation logs`](https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html) in Amazon Cloud Watch through [Anthropic's MCP (Model Control Protocol)](http
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
.codex/config.toml:8 # IAM role → environment variables → ~/.aws/credentials.AWS Payment Cryptography (MCP server)
Compatibility: Not stated.
An MCP server for [AWS Payment Cryptography (APC)](https://docs.aws.amazon.com/payment-cryptography/latest/userguide/what-is.html).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
requirements.txt:5 boto3>=1.28.0Aws Security Mcp (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server that enables AI assistants to perform comprehensive AWS security analysis through natural language queries.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:32 postinstallAXF (MCP server)
Compatibility: Not stated.
**Fit the repository once.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
plugins/axiom-versioning/skills/dependency-versions/scripts/osv_scan.py:289 urllib.request.urlopen(request, tiaxiom (Plugin)
Compatibility: Not stated.
Axiom is a curated marketplace of shared plugins for Claude Code and Codex.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL
hooks/scripts/install-telemetry.sh:201 if command -v curl >/dev/null 2>&1; thenazure (Plugin)
Compatibility: Portable across standard formats.
Transform Claude into an Azure expert.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:28 prepareAzure DevOps (ADO) (MCP server)
Compatibility: Not stated.
> [!IMPORTANT] > We recommend using the [Remote MCP Server](https://learn.microsoft.com/en-us/azure/devops/mcp-server/remote-mcp-server) instead of this local server.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
docs/assets/js/main.js:336 fetch(url).then(function (r) {Azure Sql Developer (Plugin)
Compatibility: Portable across standard formats.
Agent skills for Azure SQL Developer, the Azure SQL Database engine running locally in a container.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zBcOzWGC0" style="display:none">pcNf6CgoHkGkbQKnWqaSM7Lnno3ajbJtMxV1B6HorcqT3lPiKjhZO/0gB2B Outreach Orchestrator (Plugin)
Compatibility: Not stated.
AI-Powered B2B Outreach Plugin 2026: Persistent Briefing & 40 Skills for Claude Code
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skills/cdx-sol/cdx-sol.mjs:250 fs.rmSync(fx, { recursive: true, force: true });Babel Orchestration (Plugin)
Compatibility: Not stated.
Multi-model code review and orchestration for Claude Code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
plugins/backend-security/skills/backend-security/references/injection.md:25 - `child_process.exec`, `execSync`Backend Security Skill (Plugin)
Compatibility: Not stated.
<a id="top"></a>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
internal/cli/persona_permissions.go:202 cmd := exec.Command("npm", "install", spec, "--prefix", dir, "--no-savbaron (Plugin)
Compatibility: Not stated.
Local-first AI coding agent orchestrator with a terminal UI , isolated worktrees, a real build/lint/test gate, and policy-controlled auto-merge.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES
skills/batocera-roms/scripts/dat-verify.py:243 subprocess.run([SEVENZ, "x", "-y", f"-o{tmp}", filepath],Batocera Skills (Plugin)
Compatibility: Not stated.
Agent skills that teach coding agents to operate a Batocera arcade cabinet: ops, ROMs, display, tuning, maintenance.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skills/baidu-drive/scripts/install.sh:192 if command -v curl &> /dev/null; thenBdpan Storage (Skill)
Compatibility: Not stated.
Agent Skill for Baidu Netdisk (百度网盘) , upload, download, transfer, share, search files via natural language.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
skills/beautify-github-readme/scripts/render_motion_gif.py:184 subprocess.run(command, check=True, stdout=subpBeautify Github Readme (Skill)
Compatibility: Not stated.
README design skill for Claude Code & Codex.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +1 more
package.json:28 prepareBeecargo (MCP server)
Compatibility: Not stated.
Model Context Protocol server for the [Beecargo](https://beecargo.net) file hosting API.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
plugins/beezi/lib/accounts.mjs:83 try { fs.rmSync(target, { recursive: true, force: true }); } catch { /* ignoBeezi Claude Plugin (Plugin)
Compatibility: Claude Code.
Official Beezi plugins for Claude.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES
plugins/best-value-xianyu/browser_login.py:84 shutil.rmtree(profile, ignore_errors=True)Best Value Xianyu (Plugin)
Compatibility: Not stated.
<div align="center"> <img src="./assets/readme-hero.svg" width="100%" alt="闲鱼最优解擂台：实时查价、逐轮打擂、寻找预算内真正值得买的商品">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:26 prepareBhived MCP (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/bhived-network.png" alt="Bhived Network with personal, team, and shared lessons" width="100%"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES INSTALL_UNPINNED +2 more
tools/check_source_integrity.py:25 return subprocess.run(bibverify (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.Hylouis233/bibverify -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
plugins/blender-agent-studio/skills/blender-asset-validation/scripts/test_evidence_blender.py:16 result = subpBlender Agent Studio (Skill)
Compatibility: Not stated.
Route Blender asset creation, refinement, procedural systems, rendering, simulations, characters, validation, animation, MCP integration, and agent benchmarking work to the appropriate Blender Agent Studio workflow.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES
scripts/install_dsh.py:76 shutil.rmtree(staging, ignore_errors=True)Blender Vse (Skill)
Compatibility: Not stated.
Revision-safe Blender VSE timeline execution for agents; pair with a director Skill for end-to-end production.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:19 postinstallBoilerplate Mcp Server (MCP server)
Compatibility: Not stated.
A production-ready foundation for developing custom Model Context Protocol (MCP) servers in TypeScript.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
package.json:43 @getalby/sdkbolthub (MCP server)
Compatibility: Not stated.
The bolthub API marketplace, L402 gateways, and your other MCP servers, on one Lightning budget.
This grade is a hygiene screen, not proof of safety.
