Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 1951 to 2000 of 3,335 Grade C entries. Page 40 of 67.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:15 prepareSMSPM MCP Server (MCP server)
Compatibility: Not stated.
> MCP server for the [SMSPM](https://smspm.com) SMS API.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
deploy/cloudflare-worker.js:11 async fetch(request, env) {Social Perks (MCP server)
Compatibility: Not stated.
**The Marketing Value Protocol** , AI-powered marketing infrastructure for every business.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
examples/x402-demo.ts:278 const res = await fetch(`${cfg.horizonUrl}/accounts/${account}`);Stellar Agent Search (MCP server)
Compatibility: Not stated.
> **A read-only discovery layer on top of the [stellar-8004](https://stellar8004.com) registry , the ERC-8004-style Identity/Reputation/Validation contracts on Stellar mainnet.** > It adds no contracts and forks nothing: it exposes the existing on-chain registry to MCP clients,
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
dev.py:39 return subprocess.call(cmd, cwd=ROOT, env=_env())Talamus (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.ampres-ai/talamus -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.github/workflows/publish.yml:25 curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -yTerminal MCP Server (MCP server)
Compatibility: Not stated.
MCP server enabling AI agents to interact with terminal applications through structured Terminal State Tree representation.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
package.json:24 postinstallThoth (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
scripts/install.sh:12 # curl -fsSL https://cli.tigerdata.com | shTiger Cli (MCP server)
Compatibility: Not stated.
Tiger CLI is the command-line interface for Tiger Cloud.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
scripts/browser-issue-guard.mjs:168 fs.rmSync(tempDir, { recursive: true, force: true });TokenTrace (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="docs/assets/tokentrace-logo.svg" alt="TokenTrace logo" width="96" height="96"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.gitignore:165 credentials.jsonU2 MCP Server (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.bpamiri/u2-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
extension/extension.js:55 const r = http.request({ host: '127.0.0.1', port: p, path: '/state', method: 'GET',uisight (MCP server)
Compatibility: Not stated.
**Your AI can already see the screen.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:45 prepareUseqr Mcp (MCP server)
Compatibility: Not stated.
Static QR PNG/SVG for agents, plus a link to the UseQR designer.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
README.md:85 proc = subprocess.Popen(['./target/release/vlk-core'],Vlk MemAct (MCP server)
Compatibility: Not stated.
Vlk² gives AI agents a sense of time: what's happening now (PRESENT), what's already been tried (PAST), and what should guide future decisions (FUTURE).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
.agents/skills/tdd/mocking.md:44 getUser: (id) => fetch(`/users/${id}`),WebReaper (MCP server)
Compatibility: Not stated.
AI-native web scraper.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_UNPINNED SECRETS_PATH_CREDENTIAL
src/tools/utils.py:87 os.remove(tmp_path)Zendriver MCP (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.bituq/zendriver-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zluXjkLB0" style="display:none">ZLoUX2Z2i8Z9IcMiO7z/So0x+70Dee95WLcKbFV7VqdSpxhVZGbMvCRs4Kmetrics Adaptive Optima (Plugin)
Compatibility: Not stated.
**Welcome to Sindri Optimizer** , the open-source framework that redefines how bounded, target-driven optimization loops function in production environments.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
CHANGELOG.md:324 - **Offline-egress invariant** (`scripts/check-offline-egress.mjs`, `tests/security/offline-eAgent Context Kit (Skill)
Compatibility: Not stated.
<p align="center"> <a href="https://www.npmjs.com/package/@cynrath/agent-context-kit"><img src="https://img.shields.io/npm/v/@cynrath/agent-context-kit?label=npm&color=0B84FF&style=for-the-badge" alt="npm version"></a> <a href="https://www.npmjs.com/package/@cynrath/agent-context
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
adapters/cursor/ide_conformance.py:57 status = subprocess.run(Agent Context Os (Skill)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
evals/compatibility/gh_stub.py:18 return subprocess.run(["git", "-C", str(cwd or Path.cwd()), *values],Agent Marketplace (Plugin)
Compatibility: Not stated.
A personal plugin marketplace for AI coding agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.github/workflows/apiary-golden-behavioral.yml:41 curl -fsSL https://claude.ai/install.sh | bashAgent Plugins (Plugin)
Compatibility: Not stated.
Claude Code plugins for **agent memory and verification** , giving agents durable knowledge that improves with use, and adversarial review that catches what a single pass misses.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
skills/publishing/host/scripts/history.sh:128 result = subprocess.run(Agent Resources (Skill)
Compatibility: Not stated.
Agent skills and Cursor rules
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +3 more
app/scripts/copy-pty-prebuilds.cjs:43 fs.rmSync(RELEASE_DIR, { recursive: true });agentgrid (Skill)
Compatibility: Not stated.
Spawn grids of coding agents (Claude, Codex, Gemini, Cursor) in one command.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skills/bitrefill/references/harnesses/claude-chat.md:83 urllib.request.urlopen("https://api.bitrefill.com/x402agents (Skill)
Compatibility: Not stated.
Browse and buy gift cards, mobile top-ups, and eSIMs on Bitrefill , 1,500+ brands, 180+ countries, crypto/x402/balance payments
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
tools/install.sh:82 curl -sL https://raw.githubusercontent.com/wcgomes/agents-workspace/main/tools/install.shAgents Workspace (Skill)
Compatibility: Not stated.
**One request.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
skills/dev-timesheet-report/scripts/collect_git.py:123 proc = subprocess.run(ai (Plugin)
Compatibility: Not stated.
*Standalone plugins and skills for AI agents.*
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL
packages/coursecoach/coursecoach/scripts/grade.py:162 subprocess.run([sys.executable, sync, "--course", courseAlamo Skills (Skill)
Compatibility: Not stated.
**English** | [简体中文](README.zh-CN.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
plugins/brief/skills/brief/scripts/render.py:223 subprocess.run(["open", str(out)], check=False)arsenal (Skill)
Compatibility: Not stated.
<p align="center"> <img src="./assets/arsenal-hero.jpeg" alt="arsenal: idea to shipped, through brief and propose" width="100%"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zYyx2lsM0" style="display:none">mFPc7qK6e7JCozfg8xtCARboiypA24XORHzjL6mTyt+uTtDkoKo8yBvuAudience Shockproof Curriculum (Plugin)
Compatibility: Not stated.
**Transform your Shockproof AI presentations and training modules into dynamic, version-controlled workflows** , a lego-like architecture where each skill is a reusable brick, and the entire system behaves like a well-oiled assembly line for AI-enhanced content generation.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skills/auto-support/scripts/guardrails.py:130 return g # bare file glob (e.g. '*.pem', 'id_rsa') matches any bAuto Support (Plugin)
Compatibility: Not stated.
Answer product Discord questions from public docs only; fail-closed leak guards; escalate the unsure to founders.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zE80qYpY0" style="display:none">tHsjvzF4hvAk3Gbu4uUpQ3tvhPEnoOm/oEM7KHwXL8OCZi+1M2jBin2RBeads Morpheus Agent (Plugin)
Compatibility: Not stated.
Imagine a world where your development workflow doesn't just follow commands, but *anticipates* them.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
plugins/borgiq-builder/skills/borgiq-builder/references/python-actor.md:187 result = subprocess.run(Borgiq Skills (Plugin)
Compatibility: Not stated.
Skills for building **BorgIQ** workflows (Actors, Triggers, Flows) from your AI coding agent.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
bench/hook_parity.py:28 ROOT = Path(subprocess.check_output(["git", "rev-parse", "--show-toplevel"], text=Truebotica (Skill)
Compatibility: Not stated.
<p align="center"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/collectiveai-team/botica/main/assets/botica-dark.png" /> <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/collectiveai-team/b
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +2 more
README.md:429 curl -fsSL https://raw.githubusercontent.com/genged/capshelf/main/scripts/install.sh | shcapshelf (Skill)
Compatibility: Not stated.
<p align="center"> <img src="docs/logo.png" alt="Capshelf logo" width="200" /> </p> <h1 align="center">Capshelf</h1> <h3 align="center">Share agent skills and config across your repos.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
cargo-ai/SKILL.md:174 curl -sS -X PUT "$CARGO_BASE_URL/v1/ai/releases/draft/update" \Cargo Skills (Skill)
Compatibility: Not stated.
Build with Cargo in Claude Code , 19 skills over the cargo-ai CLI, plus the hosted MCP server (target lists, contact enrichment and verification from licensed data providers, lead scoring, CRM sync, signal monitoring, orchestration, storage, segments, projects, diagnostics) plus
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
engine/sync/sync.js:348 // fail closed. It reads every url git would use: the one the fetch (and the pull, itsCelorus Plugin (Plugin)
Compatibility: Not stated.
Sales intelligence on Indian companies and the people behind them.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zcwBIGA90" style="display:none">ziDvpjrwwQiWVVsPdfxVji6dpt5Mc9diKpzGbBn8cVT4PeOsOOCGcs8YCerebron Docs (Plugin)
Compatibility: Not stated.
---
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED SECRETS_PATH_DOTENV
package.json:10 postinstallClaude Canvas Landing (Plugin)
Compatibility: Not stated.
Marketing site for [claude-canvas](https://github.com/sgomez-dev/claude-canvas), a Claude Code plugin that opens a real interactive terminal pane beside your conversation , pick a file, approve a diff hunk, fill in a form , so answers come back as exact values instead of prose
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zjiYt14A0" style="display:none">vYbX+h8V5tx+jR71wAq40mrTVQo5cxpisLiL5WKkHs+Lm9vwHQWhpifAClaude Deck Injector (Plugin)
Compatibility: Not stated.
**Version 2.6.0 | Released January 2026 | MIT License**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:55 prepareClaude Library (Plugin)
Compatibility: Not stated.
My personal Claude Code plugins
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
claude-plugins/plugins/outline-wiki/bin/outline:130 with urllib.request.urlopen(req, timeout=TIMEOUT) as resp:Claude Outline Wiki (Plugin)
Compatibility: Not stated.
사내 Claude Code 플러그인을 배포하는 사설 마켓플레이스 리포다.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zjvTViOG0" style="display:none">bVrLDHGhaZmECbuk9jZEJazAYRbpBfQG+3pdUv8hhldbR8cGc7Eu491EClaude Plugin Hub (Plugin)
Compatibility: Not stated.
**Your single command center for discovering, deploying, and managing Claude plugins, OpenAI actions, and custom AI toolchains , all in one blazing-fast marketplace.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
guides/whatsapp-mcp.md:117 subprocess.Popen(Claude Plugins (Plugin)
Compatibility: Not stated.
Personal marketplace of Claude Code plugins.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES SECRETS_PATH_UNCONFIRMED
src/claude_reelsmith/audio.py:149 proc = subprocess.run(args, capture_output=True, text=True, timeout=timeout)Claude Reelsmith (Plugin)
Compatibility: Not stated.
Batch-finish a folder of video with Claude: enhance audio, stabilize, brand with a logo, and add news-style titles and captions.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zx3mLPpL0" style="display:none">BOpVsab4tekPHfiSq8FXRwj/ETTcijj5SOTOJlvKUY0y91m7pOjyk1ZQClaude Session Memory Core (Plugin)
Compatibility: Not stated.
Welcome to **Claude Memory Orchestrator Pro** , the first Context Memory Lifecycle Bridge that transforms ephemeral Claude Code sessions into persistent, structured knowledge repositories.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
tools/build_feed.py:43 return subprocess.run(["git", "-C", ROOT] + list(args),clawrush (Skill)
Compatibility: Not stated.
> **C(H+A)RM** is what this lab is building: a CRM for **H**uman **&** **A**gent collaboration, running on a personal second brain.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES
.agents/skills/recipe-outcome-watch/scripts/watch.py:57 subprocess.run(["taskkill", "/PID", str(process.pid),Codex Workflows (Skill)
Compatibility: Not stated.
**English** | [简体中文](README.zh-CN.md) | [日本語](README.ja.md) | [Español](README.es.md) | [한국어](README.ko.md) | [Português (Brasil)](README.pt-BR.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zIn63PtT0" style="display:none">BWyqriLgbiGbRU/Nla8LEnYk8F9V/yr514LY7AevlQozcaakIPApW8IIContext Hoarder (Plugin)
Compatibility: Not stated.
**Claude Code Context Keeper** is a proactive context preservation system designed to save your AI development sessions automatically when Claude Code's context window runs critically low.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
.github/scripts/check_version_bump.py:66 proc = subprocess.run(["git", "-C", str(ROOT), *args], capture_outputCraft Io Plugins (Plugin)
Compatibility: Not stated.
The official plugin marketplace for [Craft.io](https://www.craft.io), for Claude Code, Cursor and Gemini CLI.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
SKILL.md:78 credctl protect --strategy BASIC --program-permit /usr/bin/ssh --measure true --open-frequency 2 ~Credagent Skill (Skill)
Compatibility: Not stated.
Protects file-based credentials with CredAgent, a zero-trust FUSE system that encrypts a secret at rest and serves it back at the same path, so only authorized and SHA256-measured programs can open it.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
skills/daily-hotspots/scripts/identity_sweep.py:73 with urllib.request.urlopen(req, timeout=timeout) as r:Daily Hotspots (Plugin)
Compatibility: Not stated.
Daily business-opportunity radar with source validation, cross-day deduplication, one ranked daily headline message and private archives.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.gitignore:17 gemini-credentials.jsonDazbo Agent Skills (Skill)
Compatibility: Not stated.
This repository serves as a public collection of agentic skills developed for AI agents and assistants.
This grade is a hygiene screen, not proof of safety.
