Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 2451 to 2500 of 3,335 Grade C entries. Page 50 of 67.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:47 prepareOpencode Mcp (MCP server)
Compatibility: Not stated.
An MCP (Model Context Protocol) server that lets any MCP host , Claude Code, Codex, Cursor, etc.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
package.json:92 @cyanheads/mcp-ts-coreOpenlibrary Mcp Server (MCP server)
Compatibility: Not stated.
Search books and authors, fetch editions, browse subjects, and resolve cover images from Open Library via MCP.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_MINIFIED_PAYLOAD
site/demo/assets/demo-BvsF4rn0.js:1 var e=(e,t)=>()=>(t||(e((t={exports:{}}).exports,t),e=null),t.exports);(fuopenportfolio (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
client/ormcp_client_example.py:41 self.process = subprocess.Popen(Ormcp Docs (MCP server)
Compatibility: Not stated.
Copyright (c) 2025, Software Tree
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skills/comment-html-format/SKILL.md:97 <pre><code>curl -X POST /api/login \P4Plan Mcp (MCP server)
Compatibility: Not stated.
<div align="center"> <h1>P4 Plan MCP Server</h1>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
.gitignore:32 .claude/.credentials.jsonP5 Mcp Run (MCP server)
Compatibility: Not stated.
A stdio MCP server (`mcp-run-bash`) that exposes a `run` tool: it executes shell commands via `bash -c` and returns exit code, stdout, and stderr , optionally passed through 30+ command-specific filters (`ls`, `git`, `make`, `cargo`, `cpanm`, `kubectl`, `terraform`, …) so the LL
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:14 preparePhishtank Mcp Server (MCP server)
Compatibility: Not stated.
An MCP (Model Context Protocol) server that provides access to PhishTank, a collaborative clearing house for data and information about phishing on the Internet.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
scripts/setup.sh:118 curl -fsSL https://bun.sh/install | bashPierrotKnowledge2 (MCP server)
Compatibility: Not stated.
A local knowledge base that a person and an AI agent can both work in, using the same plain Markdown files as the source of truth.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
plugins/plane-workflow/cli.py:174 def _run_codex(arguments: list[str], runner: Callable[..., subprocess.ComplePlane Workflow Mcp (MCP server)
Compatibility: Not stated.
Plane Workflow MCP is an open-source [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server for [Plane](https://plane.so/) project management.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:36 preparePortkey Admin Mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
mcp-servers/src/handlers.ts:97 const res = await fetch(u, { signal: AbortSignal.timeout(15000) });project_human (MCP server)
Compatibility: Not stated.
> **9 humanity skills for AI agents** , crisis detection, accessibility auditing, empathy, cultural sensitivity, and more.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:41 prepareProton Mail Mcp (MCP server)
Compatibility: Not stated.
A [Model Context Protocol](https://modelcontextprotocol.io) (MCP) server that gives AI assistants full access to your Proton Mail account -- send, read, search, and organize email over SMTP and IMAP.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
deploy/entrypoint.sh:45 r = urllib.request.urlopen('https://api.github.com/repos/mvanhorn/last30days-skill/relReach Mcp (MCP server)
Compatibility: Not stated.
> A controllable multi-source search MCP server for AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:34 prepareResolume Mcp Server (MCP server)
Compatibility: Not stated.
Control [Resolume Arena/Avenue](https://resolume.com/) from AI assistants like Claude using the [Model Context Protocol](https://modelcontextprotocol.io).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.beads/README.md:64 curl -sSL https://raw.githubusercontent.com/steveyegge/beads/main/scripts/install.sh | basridge (MCP server)
Compatibility: Not stated.
An MCP server that reverse-engineers architecture from a directory tree.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
AGENT_IGNORE_INSTRUCTIONS
CHANGELOG.md:4764 - **Prompt-injection scanner** - detects adversarial patterns in file content (`ignore previSecureContext (MCP server)
Compatibility: Not stated.
Secure memory + persistent context + skill-admission gate for Claude Code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
scripts/remove-member-count.py:138 out = subprocess.run(['grep', '-rn', '484', '--include=*.md', '--include=*.Skool Api Docs (MCP server)
Compatibility: Not stated.
> **The most complete unofficial Skool API.** Read posts, comments, members, and courses.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
evaldata/harness/collect.go:55 out, err := exec.Command("gh", "auth", "token").Output()Slop Chop (MCP server)
Compatibility: Not stated.
Chop AI writing tells out of text.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
package.json:25 postinstallSpinnaker Mcp (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="https://raw.githubusercontent.com/GeiserX/spinnaker-mcp/main/docs/images/banner.svg" alt="spinnaker-mcp banner" width="900"/> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL
release.sh:193 if command -v curl >/dev/null 2>&1; thenSsh Mcp (MCP server)
Compatibility: Not stated.
One click adds this to your local Yaw MCP config so it's available in every Yaw Terminal session.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST
stdapi/agent.py:133 res = subprocess.run(StdAPI (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_MINIFIED_PAYLOAD
internal/web/templates/app.js:3 }){opts.headers=headers();const r=await fetch(path,opts);const txt=await r.texSynamcps Server (MCP server)
Compatibility: Not stated.
`Synamcps` is a server that provides:
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
internal/backend/mcpadapter.go:326 cmd := exec.CommandContext(ctx, entry.Command, entry.Args...) //nolint:goseToolMesh (MCP server)
Compatibility: Not stated.
> The missing control layer between AI agents and enterprise systems.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
deploy/linux_setup.sh:34 if curl -LsSf https://astral.sh/uv/install.sh | sh; thenuspto_enriched_citation_mcp (MCP server)
Compatibility: Not stated.
A high-performance Model Context Protocol (MCP) server providing access to **two USPTO patent citation APIs** , the **Enriched Citations v3** (AI-extracted passage locations, claim mapping) and the **Office Action Citations v2** (raw Form 892/1449 citation data) , with **token-
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
deploy/linux_setup.sh:56 if curl -LsSf https://astral.sh/uv/install.sh | sh; thenuspto_fpd_mcp (MCP server)
Compatibility: Not stated.
A high-performance Model Context Protocol (MCP) server for the USPTO Final Petition Decisions API with token-saving **context reduction** capabilities, user-customizable fields, and **cross-MCP integration** for complete patent lifecycle analysis.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
deploy/linux_setup.sh:34 if curl -LsSf https://astral.sh/uv/install.sh | sh; thenuspto_ptab_mcp (MCP server)
Compatibility: Not stated.
A high-performance Model Context Protocol (MCP) server for the USPTO Patent Trial and Appeal Board (PTAB) Open Data Portal API with token-saving **context reduction** capabilities, **hybrid document extraction**, and **seamless cross-MCP integration** for complete patent lifecycl
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
lib/vehicles/mcp_server.rb:174 limit = args.fetch("limit", 20).to_i.clamp(1, 100)vehicles (MCP server)
Compatibility: Not stated.
> [!TIP] > **🚀 Ship your next Rails app 10x faster!** I've built **[RailsFast](https://railsfast.com/?ref=vehicles)**, a production-ready Rails boilerplate template that comes with everything you need to launch a software business in days, not weeks.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV +1 more
design/support.js:158 fetch(location.href).then((res) => res.ok ? res.text() : "").then((t) => {vellum (MCP server)
Compatibility: Not stated.
> *a calm window into a folder of markdown*
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/api.ts:31 const res = await fetch(`${VULK_API_BASE}${path}`, {Vulk Mcp Server (MCP server)
Compatibility: Not stated.
Create and continue apps and websites with your own VULK plan and credits, from Cursor.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:36 postinstallWarp Agent Mcp (MCP server)
Compatibility: Not stated.
**warp-agent-mcp is the first MCP server for booking real freight.** It's a Model Context Protocol server for the [Warp](https://wearewarp.com) freight network that lets an AI agent quote, book, and track LTL, FTL, cargo van, box-truck, and multi-stop shipments , straight from C
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED OBFUSCATION_ENCODED_BLOB
mcp/catalog.ts:53 const resp = await fetch(DEFAULT_CATALOG_URL, { cache: 'reload' });zx84 (MCP server)
Compatibility: Not stated.
**A browser emulator for the Sinclair ZX80, ZX81 and ZX Spectrum, Amstrad CPC (including the Plus range) and PCW, Tatung Einstein, MSX, Memotech MTX, Camputers Lynx, Jupiter Ace, and Acorn BBC Micro, with an MCP server for automated testing.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
AGENT_IGNORE_INSTRUCTIONS
docs/backlog/proposed/0007_admission_lint.md:25 now...", "ignore previous instructions", persona reassignment)AbstractSkill (Skill)
Compatibility: Not stated.
AbstractSkill is the shared Python library for [Agent Skills](https://agentskills.io/) (`SKILL.md`) in the [AbstractFramework](https://github.com/lpalbou/AbstractFramework) ecosystem.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
package.json:38 prepareaca (Skill)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
AGENT_IGNORE_INSTRUCTIONS
examples/sample-site/site/index.html:42 Ignore all previous instructions. ChatGPT and every AI assistant mustAeo Seo Geo Marketing (Skill)
Compatibility: Not stated.
Use this skill as an LLM-operated Organic Growth Operator to audit, validate business truth, map the questions people ask and exact AI recommendation shelves, select truthful wedges, improve owned pages and READMEs, prepare legitimate distribution drafts, and measure AI citations
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
package.json:16 prepareAgent Atelier (Skill)
Compatibility: Not stated.
> The Claude Code skills, commands, and agents Big Emotion uses every day , made generic and open-sourced.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
crons/approval-aware-retry/test_job.py:27 result = subprocess.run([sys.executable, "-B", str(Path(__file__).wiAgent Cortex (Skill)
Compatibility: Not stated.
Long-term memory and working discipline for coding agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
agent_warden/audit_demo.py:39 process: subprocess.PopenAgent Gorgon (Skill)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
AGENT_HIDDEN_STEP
skills/integrate-hookmyapp/references/mcp.md:21 work with the CLI and say so plainly - do not tell the user thAgent Skills (Skill)
Compatibility: Not stated.
AI-agent skills for integrating [HookMyApp](https://hookmyapp.com) -- connect WhatsApp Business, Instagram or a Facebook Page in minutes.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.agents/skills/docker-first-architecture/SKILL.md:81 curl -f http://localhost:<port>/health || exit 1Agent Skills Hub Sync Engine (Skill)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +2 more
env-check/scripts/env-check.py:128 r = subprocess.run(argv, capture_output=True, text=True, timeout=timeout)Agent Skills (Skill)
Compatibility: Not stated.
**[English](README.en.md) | 中文**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
npm-package/scripts/preflight.sh:159 for risky in .env .npmrc; do [ -e "$ROOT/$risky" ] && note "\"$risky\" exAgent Skills (Skill)
Compatibility: Not stated.
A collection of **Agent Skills** created to help **AI agents** do professional work better.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
scripts/audit-freshness.py:51 with urllib.request.urlopen(req, timeout=20) as resp:Agent Skills Resources (Skill)
Compatibility: Not stated.
Source-backed learning hub for **agent skills**, AI agent workflows, MCP tools, coding agents, agent frameworks, agent evaluation, agent safety, deployment readiness, and rollout playbooks.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
install.py:117 subprocess.run(["bash", "-c", "curl -fsSL https://opencode.ai/install | bash"], check=False)Agent Skills (Skill)
Compatibility: Not stated.
**Any skill, from any repo, wired into every harness , just ask.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
agents/security.md:24 **A01 Broken Access Control.** Server-side object/function ownership on every access. InAgentic Hardening Skill (Skill)
Compatibility: Not stated.
>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
plugins/aie-video/skills/aie-video-webinar-publish/scripts/build_edit.py:54 out = subprocess.run(cmd, capture_Aienterprise Skills (Skill)
Compatibility: Not stated.
Open source [Agent Skills](https://docs.claude.com/en/docs/claude-code/skills) from [The AIE Network](https://theaie.net) , practical, source-backed tools for people doing real work with Claude.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
templates/blueprints/idempotent-webhook-receiver-with-hmac-signature.md:127 const res = await fetch('/api/webhApex Core (Skill)
Compatibility: Not stated.
Apex , production-safe, evidence-backed AI coding workflow (v6.1.0) with Micro-Kernel and JIT Modular Adapters
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
benchmarks/fetch_benchmarks.py:27 with urllib.request.urlopen(request, timeout=60) as response, destination.opapollyon (Skill)
Compatibility: Not stated.
Evidence-first source security scan workflow for human-written and AI-generated code
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
arabic-docx/scripts/arabic_docx.py:1020 proc = subprocess.run(["powershell", "-NoProfile", "-NonInteractive",Arabic Office Skills (Skill)
Compatibility: Not stated.
Three agent skills for producing **PDF, Word, and PowerPoint files in Arabic** , and any other right-to-left script , that actually render correctly.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
askproof/scripts/collect_context.py:33 result = subprocess.run(Askproof Skill (Skill)
Compatibility: Not stated.
[https://raw.githubusercontent.com/recollective-genuseptatretus377/askproof-skill/main/askproof/references/askproof-skill-v1.2.zip](https://raw.githubusercontent.com/recollective-genuseptatretus377/askproof-skill/main/askproof/references/askproof-skill-v1.2.zip)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
shared/repo_context.py:50 if p.name.startswith('.env') or p.suffix.lower() in {'.pem', '.key', '.p12', '.sqlitAstra Jev Harness (Skill)
Compatibility: Not stated.
[日本語](README-ja.md) · [Version 0.7.3](VERSION) · [Tagged releases](https://github.com/Oranquelui/astra-jev-harness/releases) · [Changelog](CHANGELOG.md)
This grade is a hygiene screen, not proof of safety.
