Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 2351 to 2400 of 3,335 Grade C entries. Page 48 of 67.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zkiwcN1w0" style="display:none">VDWIGmMWPPwMN5mGxYseXTTFyFcz/pwUnjSrl30f9hBiKIQQYQZ7hlV6Wealth Atlas (Plugin)
Compatibility: Not stated.
---
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
web-taste/scripts/test_workflow.py:393 result = subprocess.run([sys.executable, str(SCRIPT), '--library-root',Web Taste (Skill)
Compatibility: Not stated.
**Teach your coding agent your taste, not a template.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
skills/dbs-video-extract/scripts/extract_video_transcript.py:158 with urllib.request.urlopen(request, timeout=Wepr Growth Skills (Skill)
Compatibility: Not stated.
[中文](#中文说明) · [English](#english)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL OBFUSCATION_ENCODED_BLOB
tools/symbol-bench/bench.js:278 const version = await (await fetch("/version", { cache: "no-store" })).text();Wire Lang (Skill)
Compatibility: Not stated.
<p align="center"> <picture> <source media="(prefers-color-scheme: dark)" srcset="./docs/brand/assets/wire-lang-lockup-horizontal-reversed.svg"> <img src="./docs/brand/assets/wire-lang-lockup-horizontal.svg" alt="Wire Lang" width="420"> </picture> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
plugins/contract-check/skills/contract-check/references/legal-sources.md:36 curl -s "https://laws.e-gov.go.jp/Work Contract Check (Plugin)
Compatibility: Not stated.
日本の契約実務向け [Claude Code](https://claude.com/claude-code) プラグイン集です。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.repo-safety/config.json:37 "id_rsa",Workflow Herdr (Skill)
Compatibility: Not stated.
>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
extension/background.js:117 const socket = new WebSocket(BRIDGE_URL);Xiaohongshu Skill (Skill)
Compatibility: Not stated.
|
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST
skills/competitive-intel/SKILL.md:141 subprocess.run(['mcporter', 'config', 'remove', 'xpoz'], capture_output=Xpoz Agent Skills (Skill)
Compatibility: Not stated.
---
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
plugins/assay/skills/assay/SKILL.md:252 sh -c "$(curl -fsSL https://app.goassay.io/helper/install.sh)"Assay Plugins (Plugin)
Compatibility: Not stated.
Publish a task to [Assay](https://goassay.io) from inside your own coding session , code, a document, a deck, any kind of work , or take paid work from it.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
src/Anonymizer/Dumper.php:45 $process = proc_open($argv, [agent (MCP server)
Compatibility: Not stated.
<h1 align="center">Cipi Agent for Laravel</h1>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +2 more
package.json:16 prepareAgent Loom (MCP server)
Compatibility: Not stated.
Durable local mail and advisory coordination between coding-agent sessions.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
package.json:24 postinstallAgent Passport Mcp (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.agent-passport-system/agent-passport-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:33 prepareagentaos (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB
packages/cli/src/bridge.ts:44 const response = await fetch(`${this.localBase}${request.path}`, {agenthop (MCP server)
Compatibility: Not stated.
**Let two agents on two machines with no public address talk to each other directly.** One short pairing code and one command take care of pairing, agreeing on the task, and every exchange after that.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES SECRETS_PATH_DOTENV
src/semantic_engine/manage_semantics.py:143 shutil.rmtree(PROJECT_DIR)Agentic Analytics System (MCP server)
Compatibility: Not stated.
A local, open-source stack for building conversational data agents and semantic reasoning workflows over an Iceberg Lakehouse.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
install.sh:24 if command -v curl >/dev/null 2>&1; thenAgentic Dns (MCP server)
Compatibility: Not stated.
**Agentic AI-Native DNS Routing, Diagnostics & Telemetry.** Manages a complete DNS resolution chain (Pi-hole -> CoreDNS -> dnsdist -> Unbound/Stubby/DNSCrypt -> VPN DNS) with CLI, REST API, stdio MCP, and a Rust DoT/mTLS proxy server.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
README.md:218 If an agent attempts to access `/etc/passwd` or `../../../../ssh/id_rsa` while the server was reAgentic Filesystem Mcp (MCP server)
Compatibility: Not stated.
**Agentic Filesystem MCP Server** is a secure, highly capable Model Context Protocol (MCP) server written in Rust.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
references/research/02-troubleshooting-guide.md:234 subprocess.check_call([sys.executable, '-m', 'pip', 'instaAgentic Kaggle Skill (MCP server)
Compatibility: Not stated.
|
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
src/floeAgent.ts:386 async fetch(input: string | X402FetchInput): Promise<FetchResult> {Agentkit Actions (MCP server)
Compatibility: Not stated.
**The TypeScript SDK for Floe , know what every AI call really costs.** Floe costs each call the moment it ends across every vendor , telephony, STT, LLM, TTS, search, data , on one ledger, ties the spend to the client and campaign, and shows your margin per contract; then you
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
plugin/scripts/recipes.py:89 os.remove(p)Ai Crew Sync (MCP server)
Compatibility: Not stated.
*Read this in [Spanish](README.es.md).*
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
scripts/setup-dev.sh:12 echo " curl -LsSf https://astral.sh/uv/install.sh | sh"aiochainscan (MCP server)
Compatibility: Not stated.
`aiochainscan` reads on-chain history from public block explorers across 85 chains through one async client , and hands it back usable, not raw.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
examples/external_agent_trace_demo.py:33 def _send(proc: subprocess.Popen[str], request: dict[str, Any]) -> diAlr Tw (MCP server)
Compatibility: Not stated.
連接 AI 代理與台灣官方法律來源，提供研究流程、來源查證、證據綁定與答案驗證。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
scripts/agents_smoke.py:67 self.process = subprocess.Popen(assemblash (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/assemblash-mark.svg" width="112" alt="Assemblash logo"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
scripts/fixtures/fake-agent.mjs:130 fs.rmSync(statePath, { force: true });Ast Mcp Server (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/header.jpg" alt="Abstract network of connected code symbols with the text AST MCP Server." width="100%" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
docs/SECURITY.md:45 * SSH keys: `id_rsa*`, `id_ed25519*`, `id_dsa*`, `id_ecdsa*`ASTral (MCP server)
Compatibility: Not stated.
Most AI agents explore repositories the expensive way: open entire files > skim thousands of irrelevant lines > repeat.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
src/bad_ass_mcp/backend/base.py:291 proc = subprocess.Popen(Bad Ass Mcp (MCP server)
Compatibility: Not stated.
*Every other tool needs a browser or a vision model.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
package.json:12 postinstallBitcoin Mcp (MCP server)
Compatibility: Not stated.
> **Real-time Bitcoin blockchain data in your AI workflow.** Query addresses, transactions, blocks, and UTXOs from the mempool.space API.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
src/server.rs:818 let bug = fetch(reference.clone()).await?;Bugboard Mcp (MCP server)
Compatibility: Not stated.
`bugboard-mcp` gives an MCP client access to projects, versions, bugs, history, subscriptions, and votes in the 1C Bugboard.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
docs/COFFEESHOP_DEMO.md:29 curl -fsSL https://tailscale.com/install.sh | shBumi Mcp (MCP server)
Compatibility: Not stated.
<p align="center"> <a href="https://github.com/casey/just"><img src="https://img.shields.io/badge/just-ready_to_go-7c5cfc?style=flat-square&logo=just&logoColor=white" alt="Just"></a> <a href="https://github.com/astral-sh/ruff"><img src="https://img.shields.io/endpoint?url=https:/
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
plans/v2-foundation-round1-wal-probe.py:148 child_result = subprocess.run( # noqa: S603 - fixed synthetic chilcairntir (MCP server)
Compatibility: Not stated.
Memory-first reasoning layer for Claude Code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
src/carbone/client.ts:544 response = await fetch(`${this.baseUrl}${endpoint}`, {Carbone Mcp (MCP server)
Compatibility: Not stated.
Generate PDF, Word, Excel and PowerPoint documents from templates and JSON data, and convert files across 100+ formats, with the Carbone API.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +1 more
test_cascade.py:8 sys.exit(subprocess.call([sys.executable, "tests/test_gateway.py"]))CascadeGateway (MCP server)
Compatibility: Not stated.
**CascadeGateway** is an intelligent, hardware-adaptive cascading proxy that routes AI queries between local GPUs (via Ollama at **$0 token cost**) and frontier cloud models (Google Gemini, OpenAI, etc.).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
src/config.ts:145 fs.unlinkSync(envPath);Cellartracker Mcp (MCP server)
Compatibility: Not stated.
CellarTracker wine cellar management , MCP tools for inventory, drinking recommendations, purchase history, and wishlist.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
bin/todos.ts:40 const response = await fetch(`${boardOrigin()}/api/health`, {Claude Manual Todos Plugin (MCP server)
Compatibility: Not stated.
Records, orders and tracks the manual tasks only the user can do: what is left waiting in a console, a dashboard or an account Claude cannot reach.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/linux-vm-smoke.sh:69 curl -fL "$ARTIFACT_URL" -o cloche.tar.gzcloche (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="docs/assets/cloche-social-preview.jpg" alt="Cloche banner" width="900"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
packages/cli/src/cli.js:433 try { fs.rmSync(dir, { force: true, recursive: true }); } catch {}cloud189 (MCP server)
Compatibility: Not stated.
> **Secure, reliable, extensible, free cloud storage for AI agents, powered by Tianyi Cloud 189 / 天翼云盘.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
.github/verify.py:159 r = subprocess.run(("git", *args), capture_output=True, text=True)Code Audit Protocol (MCP server)
Compatibility: Not stated.
Audits a code change against a 54-phase failure taxonomy and reports what it did not check, not just what it found.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
benchmarks/snippet_06_hardcoded_credentials.py:24 response = requests.post(Code Review Agent Mcp (MCP server)
Compatibility: Not stated.
> AI code review agent that doesn't sugarcoat.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
codecks_cli/commands.py:498 os.remove(config.CACHE_PATH)Codecks Cli (MCP server)
Compatibility: Not stated.
Game developers should be making games, not managing task boards.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
internal/cli/app.go:449 cmd := exec.CommandContext(ctx, "go", cmdArgs...)codegraph (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="docs/banner.svg" alt="codegraph" width="100%"/> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
requirements.txt:1 agent-connector-sdk[mcp]>=0.3.11,<1.0.0Container Manager Mcp (MCP server)
Compatibility: Not stated.
*Version: 3.3.4*
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
contradiction-mcp/src/connectors/document/documentConnector.ts:197 const xml = child_process.execFileSync('unzContradiction Mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
package.json:18 prepareControl D Mcp (MCP server)
Compatibility: Not stated.
An MCP (Model Context Protocol) server for the [Control D](https://controld.com) DNS service API.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.machine_readable/contractiles/Trustfile.a2ml:35 - run: test ! -f .env && test ! -f credentials.json && test !Coord Tui (MCP server)
Compatibility: Not stated.
Terminal UI for BoJ local-coord-mcp , peer discovery, task coordination, and window titling for multi-instance AI sessions
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:36 prepareCrawlgraph Mcp (MCP server)
Compatibility: Not stated.
Five MCP tools for backlink research using [CrawlGraph](https://crawlgraph.com) and Common Crawl snapshots: `backlinks`, `backlink_changes`, `gap_analysis`, `gap_outreach_targets`, and `releases`.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
bench/bench.py:35 self.p = subprocess.Popen([EXE], stdin=subprocess.PIPE, stdout=subprocess.PIPE,Desktop Computer Use (MCP server)
Compatibility: Not stated.
<p align="left"> <img alt="License: MIT" src="https://img.shields.io/github/license/dev-willbird1936/Desktop-Computer-Use"> <img alt="Latest release" src="https://img.shields.io/github/v/release/dev-willbird1936/Desktop-Computer-Use"> <img alt="Platform: Windows" src="https://img
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
orca-docker-vm/infra.Dockerfile:43 RUN curl -fsSL https://claude.ai/install.sh | bash \Django Unfold Agentic Layer (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.agents/skills/talkies/SKILL.md:90 curl -s $TALKIES_URL/v1/models | jqDocker Talkies (MCP server)
Compatibility: Not stated.
Self-hosted speech services in one Docker image: OpenAI-compatible file transcription and text-to-speech, Talkies live ASR over WebSocket, file staging, model lifecycle controls, and an MCP endpoint for ASR workflows.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/device_metrics.rs:31 pub async fn fetch() -> AnyhowResult<Self> {droidsight (MCP server)
Compatibility: Not stated.
An MCP server that drives a real Android device over ADB , and hands the agent back the screen its action produced.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:68 prepareEffect Actions (MCP server)
Compatibility: Not stated.
Define Effect action contracts once and project them onto HTTP, MCP, Effect RPC, native Toolkits, and CLIs.
This grade is a hygiene screen, not proof of safety.
