Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 201 to 250 of 3,335 Grade C entries. Page 5 of 67.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
boss_hr/adapters/browser_environment.py:150 proc = subprocess.Popen(Boss Hr Agent Toolkit (Skill)
Compatibility: Not stated.
<p align="center"> <img src="docs/assets/boss-hr-poster.png" alt="BOSS HR Agent Toolkit：让招聘筛选，更有章法。岗位解析、简历获取、逐份评分与可视化报告。" width="100%"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_UNCONFIRMED
brain_mcp/recorder/cli.py:155 subprocess.run(["launchctl", "unload", str(plist)], capture_output=True)Brain Mcp (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.mordechaipotash/brain-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
bin/cli.js:35 fs.rmSync(dir, { recursive: true, force: true });Bria Skill (Skill)
Compatibility: Not stated.
Generate, edit, and precisely control images directly from your AI coding agent using [Bria.ai](https://bria.ai)'s commercially-safe models.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
skills/agent-onboarding/SKILL.md:253 curl -sS https://api.brightdata.com/request \Brightdata Plugin (Plugin)
Compatibility: Claude Code.
Web scraping, Google search, structured data extraction, and MCP server integration powered by Bright Data.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:15 prepareBrowser Mcp (MCP server)
Compatibility: Not stated.
Claude Code plugin for browser automation
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
scripts/check.sh:46 curl -sf --max-time 10 "${SEARXNG_URL}?format=json&q=health" >/dev/null 2>&1Browser Search (Skill)
Compatibility: Not stated.
A skill for AI agents: search the web with SearXNG, browse with Camofox, bypass protections with CloakBrowser.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
app/native-server/src/file-handler-unique.test.ts:82 fs.unlinkSync(siblingPath);browserpaw (MCP server)
Compatibility: Not stated.
<div align="center"> <img src="./docs/images/logo.png" width="128" alt="BrowserPaw Logo" /> <h1>BrowserPaw</h1> <p><b>Control your everyday Chrome browser from AI agents, without losing logins or focus.</b></p> <p> <a href="./docs/MAP.md">Project Map</a> · <a href="./docs/TOOLS.m
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED +3 more
src/bruno/environment.ts:120 await fs.unlink(envFilePath);Bruno Mcp (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server for generating Bruno API testing files programmatically.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skills/auditing/references/audit-checks.json:131 {"id": "OC5", "category": "security/opencode_plugins", "groupBundles Forge (Plugin)
Compatibility: Portable across standard formats.
An agentic skills framework & bundle-plugin engineering toolkit that works.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK
uninstall.js:47 fs.unlinkSync(file);Burn Your Money (Plugin)
Compatibility: Not stated.
> **"看着你的存款实时归零。"**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
by2kb/agent_install.py:28 shutil.rmtree(target)by2kb (Skill)
Compatibility: Not stated.
**Forward a video.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES INSTALL_UNPINNED +1 more
build.py:143 shutil.rmtree(path)Caelune (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
README.md:3 > **The hosted Google Calendar MCP server.** Connect any AI agent to your Google Calendar in aboutCalendarMCP (MCP server)
Compatibility: Not stated.
Hosted Google Calendar MCP server for AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
src/rec/cli.py:915 result = subprocess.run(argv, capture_output=True, text=True, check=False)Call Copilot (MCP server)
Compatibility: Not stated.
> One thing.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
deploy/setup.sh:80 echo " curl -X POST https://mcp.illinihunt.org/mcp \\"Canvas Mcp (Skill)
Compatibility: Not stated.
Canvas LMS MCP server , up to 102 tools and 8 agent skills for students & educators.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
package.json:53 prepareCapcut Cli (Skill)
Compatibility: Not stated.
Independent, unofficial CLI to edit CapCut and JianYing (剪映) projects , subtitles, timing, speed, volume, templates, cut long-form to shorts.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
capsule/contract.py:209 result = subprocess.run(capsule (Skill)
Compatibility: Not stated.
Agent control plane for governed, replayable execution.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/install_all_hermes_skills.py:59 subprocess.run(cmd, check=True)Carl Skills (Skill)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +1 more
.github/scripts/docs_review_agent.py:93 meta = json.loads(subprocess.check_output(CatchAll (MCP server)
Compatibility: Not stated.
Web search API for comprehensive event retrieval: find every relevant event across the open web, not just the top results.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST
causal_graph/storage.py:19 os.remove(tmp)Causal Graph Harness (Plugin)
Compatibility: Not stated.
Auditable causal-graph research plus an optional opportunity-scout skill that helps agents avoid premature verdicts and notice practical next moves.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
scripts/git-files.py:23 proc = subprocess.Popen(command, cwd=request["cwd"], env=env, stdin=subprocess.DEVNULLCc Git Graph (Plugin)
Compatibility: Not stated.
Browse Git history in a panel beside your Claude Code conversation.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
skills/golang-benchmark/references/pprof.md:690 curl -o heap.prof http://localhost:6060/debug/pprof/heapCc Skills Golang (Skill)
Compatibility: Not stated.
🧑🎨 A collection of Golang agentic skills that works
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/evals/evaluate-skill-routing.py:69 result = subprocess.run(Cc Thingz (Skill)
Compatibility: Not stated.
Portable skills, agents, hooks, and Pi-native extensions for Claude Code, Codex CLI, GitHub Copilot, Cursor, Grok, and Pi.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_MINIFIED_PAYLOAD
claude-code-model-badge.js:55 const USAGE_BADGE = '(()=>{try{let G=globalThis,K="__ccUsageBadge",LS="cc-usage-Cc Vscode Statusbar (Plugin)
Compatibility: Not stated.
Brings improved statusbar to Claude Code VSCode extension.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
xbot/queue_executor.py:186 os.remove(tmp_path)cdpilot (MCP server)
Compatibility: Not stated.
> Zero-dependency browser automation from your terminal.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:13 prepareCe Pattern Kit (Skill)
Compatibility: Not stated.
Toolkit for the CE Pattern, a minimal, rule-based structure for organizing UI components.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
src/challenge_plans/adapters.py:127 r = subprocess.run(["claude", "-p", "--output-format", "text", "ok"],Challenge Plans (Skill)
Compatibility: Not stated.
Before you execute a drafted plan/spec/design doc, run a multi-agent adversarial cross-review to surface the flaws that cause downstream rework, aggregating "evidenced, cross-family-verified" objections into a verdict.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
conformance/harness/harness.ts:64 const res = await fetch(this.url, {chap (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +2 more
scripts/ensure_hook.py:29 result = subprocess.run(Chatgpt Web2Api (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
skills/silkscreen-cleanup/scripts/kicad_silk_audit.py:50 completed = subprocess.run(chatpcba (Plugin)
Compatibility: Not stated.
Evidence-gated PCBA workflow with reusable engineering skills and a governed online rule registry.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
benchmarks/agentic/run.js:58 process.on('exit', () => fs.rmSync(ISO, { recursive: true, force: true }));Chisle (Plugin)
Compatibility: Portable across standard formats.
Cut your AI coding agent's token bill on three axes: terse prose, YAGNI-first code, and tool-output compression.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
plugins/choice-pilot/scripts/smoke-test.mjs:71 const health = await fetch(healthUrl);Choice Pilot (Plugin)
Compatibility: Not stated.
Context-aware clickable choices for Codex and MCP Apps.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
plugins/claimmate/scripts/claimmate_core/documents.py:5 result = subprocess.run(claimmate (Plugin)
Compatibility: Not stated.
ClaimMate 是一个面向出差报销的 ChatGPT/Codex 插件。它使用大模型识别材料类型、费用类型、金额、项目归属和材料配对，并通过可维护的报销要求表检查材料完整性。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
hooks/guard.py:109 r"\.env(?:\.[\w.-]+)?|\.envrc|\.netrc|\.npmrc|\.pgpass|\.pypirc|\.git-credentials|"Claude 1Password (Plugin)
Compatibility: Not stated.
Save a secret: a small window opens that Claude cannot see, you paste there, it lands in 1Password.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
scripts/deferred-migration-export.cjs:153 try { fs.rmSync(job.startupShortcut, { force: true }); } catch { /*Claude Account Switch (Plugin)
Compatibility: Not stated.
A keyboard-driven TUI for keeping independent sets of **Claude Code** and **Codex** ChatGPT accounts.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
claude_ads_core/cockpit_demo.py:51 shutil.rmtree(destination.name, dir_fd=parent.fd, ignore_errors=True)Claude Ads (Skill)
Compatibility: Not stated.
Claude-first paid-media operations skill for Claude Code across 12 ad platforms (Google, Meta, YouTube, LinkedIn, TikTok, Microsoft, Apple, Amazon, Reddit, Pinterest, Snapchat, X): source-grounded audits, deterministic scoring, versioned JSON reports, and capability-gated account
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
curl/examples.md:16 curl https://api.anthropic.com/v1/messages \Claude Api (Skill)
Compatibility: Claude Code.
|-
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
relay.py:67 def fetch(peer, since_id, channel=None):Claude Bridge (Plugin)
Compatibility: Not stated.
Connect two Claude Code ,codex and grok sessions different users too, , your laptop and your VPS.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zjVHapgJ0" style="display:none">hDvkhiXbhTZLqYwUgxKdp2Gto2AZhQmd5nce+kAlwQCyJuiMJ8vCTBLkClaude Browser Automator (Plugin)
Compatibility: Not stated.
**Version 1.0.0 | MIT License | 2026 Release**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
server.mjs:151 fs.rmSync(entryPath, { recursive: true, force: true });Claude Code Dashboard (Plugin)
Compatibility: Not stated.
Local web dashboard for Claude Code , monitor rate limits, manage agents/skills/hooks/MCP servers, browse session history, track daily activity and usage rankings
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
scripts/gws-token-wrapper.sh:39 resp = json.loads(urllib.request.urlopen(req).read())Claude Code Google Workspace (MCP server)
Compatibility: Not stated.
Give Claude Code access to Gmail, Google Drive, Calendar, Sheets, Docs, and Slack , with full support for multiple Google accounts (e.g., personal + work).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
requirements.txt:1 fastapi>=0.115Claude Code Monitor (Plugin)
Compatibility: Not stated.
Local usage, cost and failure dashboard for Claude Code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skills/claude-automation-recommender/references/hooks-patterns.md:85 | `credentials.json`, `secrets.yaml` | SeClaude Code Setup (Plugin)
Compatibility: Claude Code.
Analyze codebases and recommend tailored Claude Code automations such as hooks, skills, MCP servers, and subagents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.gitignore:24 id_rsa*Claude Code Vm (MCP server)
Compatibility: Not stated.
Automated deployment system for Claude Code development environments on Debian VMs.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:11 prepareClaude Code Workflows (Skill)
Compatibility: Not stated.
Development workflows for Claude Code that keep broad exploration focused on the outcome you approved.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
scripts/build-adapter-knowledge.js:105 fs.rmSync(fullPath, { recursive: true, force: true });Claude Content Writer (Skill)
Compatibility: Not stated.
|
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
.claude-plugin/hooks.json:9 "command": "python3 -c \"import json,subprocess,os; d=json.load(open(os.path.expanClaude Echolog (Plugin)
Compatibility: Not stated.
Stop rediscovering.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/claude_google_sheets/setup.py:93 credentials_path = os.path.join(self.credentials_dir, "credentials.json")Claude Google Sheets Mcp (MCP server)
Compatibility: Not stated.
A comprehensive Model Context Protocol (MCP) server for Google Sheets integration with Claude.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
skills/cloudflare-workers/SKILL.md:54 async fetch(request: Request, env: Env): Promise<Response> {Claude Googleadsagent (Plugin)
Compatibility: Not stated.
The most comprehensive Google Ads and advertising automation plugin for Claude Code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
scripts/claude-companion.mjs:1037 fs.rmSync(resolveReservedJobFile(workspaceRoot, jobId), { force: true });Claude In Codex (Plugin)
Compatibility: Not stated.
<p align="center"> <img src="assets/claude-in-codex-hero.svg" alt="claude-in-codex" width="820" /> </p>
This grade is a hygiene screen, not proof of safety.
