Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 2701 to 2750 of 3,335 Grade C entries. Page 55 of 67.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:10 prepareZoko Mcp (MCP server)
Compatibility: Not stated.
Read-only MCP server for integrating [Zoko](https://www.zoko.io) with AI assistants like Claude.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES SECRETS_PATH_DOTENV
skills/computer-history-collector/scripts/computer_history_collector.py:207 result = subprocess.run(A Particular Set Of Skills (Skill)
Compatibility: Not stated.
Models and agents can be replaced.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:55 prepareadversary (Skill)
Compatibility: Not stated.
Adversarial QA for AI-generated software , the QA engineer your coding agent can't fool.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
evals/_harness/run_skill.py:75 proc = subprocess.run(Advertising Skills (Skill)
Compatibility: Not stated.
Skills for paid advertising , channel selection, budget policy, audience design, creative development, and measurement across search, paid social, video, native, and AI-answer surfaces.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
install.sh:31 curl -fsSL "${release_base}/${asset}" -o "${archive}"Agent Preview (Skill)
Compatibility: Not stated.
Automatically return a temporary browser link after Claude Code creates an HTML page, static site, or other browser-previewable artifact.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
skills/implementing-legend-state/references/observables.md:136 const server$ = observable(() => fetch('url').tAgent Skills (Skill)
Compatibility: Not stated.
Opinionated [agent skills](https://agentskills.io) for Claude Code, Cursor, Codex, OpenCode, and any other agent that speaks the [skills.sh](https://skills.sh) format.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
scripts/check-installs.py:22 return subprocess.run(['git', *args], stdout=subprocess.PIPE, text=True, check=TrAgent Skills (Skill)
Compatibility: Not stated.
Personal agent skills for planning, building, reviewing, and explaining software.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
row-bot-docker-setup/README.md:218 curl https://ollama.ai/install.sh | shAgent Skills (Skill)
Compatibility: Not stated.
A personal, curated library of skills for AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_UNCONFIRMED
skills/explainer/scripts/align_narration.py:32 duration = float(subprocess.check_output(["ffprobe", "-v", "errAgent Skills (Skill)
Compatibility: Not stated.
Portable skill library for architecture, code quality, prompt maintenance, research, interview-led builds, and multi-agent workflows.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
.agents/hooks/markdown_lint_check.py:173 result = subprocess.run(Agent Standards (Skill)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.github/workflows/validate.yml:18 curl -fsSL https://claude.ai/install.sh | bashAgent Toolkit (Skill)
Compatibility: Not stated.
Personal agent toolkit: individually installable skills for Claude Code and Codex.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
apps/cli/skills/ip-lookup/scripts/invoke.js:26 const res = await fetch(url, { headers: { 'User-Agent': 'AgentOAgentOctopus (Skill)
Compatibility: Not stated.
> Intelligent routing layer that connects user needs to Skills , install once, works everywhere.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
README.md:27 curl -fsSL https://github.com/storious/agulater/releases/download/v0.2.1/install.sh | shagulater (Skill)
Compatibility: Not stated.
Agulater is an optional lifecycle and package tool for [Agul](https://github.com/storious/agul).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_MINIFIED_PAYLOAD
src/WatermarkRemover.CLI/wwwroot/_astro/format.DyQ9F1g-.js:1 Type","application/json");const a=await fetch(`${Ai Watermark Remover (Skill)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_MINIFIED_PAYLOAD
skills/plan-agent-tasks/assets/dashboard/resources/panel.js:267 const response=await fetch('api/status',{cacheAi Workflow Skills (Skill)
Compatibility: Not stated.
Reusable workflows for AI agents, with task cards, examples, and explicit execution boundaries.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
docs/backends.md:39 's global bin. The official installer (`curl -fsSL https://x.ai/cli/install.sh | bash`) inaibridge (Skill)
Compatibility: Not stated.
<div align="center"> <img src="assets/logo.png" alt="aibridge logo" width="140" />
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED INSTALL_UNPINNED
scripts/retouch.py:104 subprocess.Popen(['open', path])Aie Skills (Skill)
Compatibility: Not stated.
专业修图师技能。支持查看直方图、提取EXIF镜头信息、调整色温/高光/阴影/曝光/对比度/饱和度、局部修图（径向/矩形局部调整、瑕疵修复、磨皮）、降噪、丁达尔光（体积光）、构图裁剪、青橙/冷灰等颜色分级、观察图像，并支持RAW文件。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
references/02-testflight-ios.md:80 Watch and Live Activity widgets need their own provisioning profiles in `crApp Store Review Playbook (Skill)
Compatibility: Not stated.
End-to-end guide for building and shipping a mobile app to the App Store and Google Play, written from real rejections and real build failures.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
00_meta/scripts/ingest_github_repo.py:61 # Using subprocess.run for better control and error handlingarchivum (Skill)
Compatibility: Not stated.
<p align="center"> <a href="https://antreas.io/archivum/"> <img src="assets/archivum-mimic.png" width="160" alt="Archivum’s winged archive mimic mascot"> </a> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
tools/verify_public_repo.py:56 result=subprocess.run(Asic Intelligence Plugin Skill Package (Skill)
Compatibility: Not stated.
**Powered by ASIC Intelligence** **Read-only Bitcoin ASIC diagnostics from the evidence you already have.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_DOTENV OBFUSCATION_MINIFIED_PAYLOAD
.gitignore:7 .envAudit Reasoning (Skill)
Compatibility: Not stated.
Audit a local Codex session or response turn using trace timing events, reporting activity percentages and locating unclassified gaps between model output, tool calls, tool results and turn boundaries.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:39 prepareazdospec (Skill)
Compatibility: Not stated.
Remote-first spec-driven development for Azure DevOps.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
packages/cli/src/v2-commands.ts:74 const response = await dependencies.fetch(input, { ...init, signal: controlbbbbb (Skill)
Compatibility: Not stated.
[English](README.md) | [简体中文](README.zh-CN.md) | [Español](README.es.md) | [日本語](README.ja.md) | [Deutsch](README.de.md) | [Français](README.fr.md) | [Português (Brasil)](README.pt-BR.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
bin/kaiva-bridge.js:25 const bridgeFetch = (url, init = {}) => fetch(url, { ...init, headers: { 'User-Agent':bridge (Skill)
Compatibility: Not stated.
Give Claude Code real access to an API, a database, documents or a remote MCP server through Kaiva Bridge hosted MCP servers.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
superqa_tui/cli.py:211 subprocess.run(["open" if sys.platform == "darwin" else "xdg-open", path],Browser Qa (Skill)
Compatibility: Not stated.
Browser QA with reviewable YAML scenarios.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
scripts/bootstrap.sh:7 # curl -fsSL https://raw.githubusercontent.com/Mexregkan/chatgpt-for-researchers/main/sChatgpt For Researchers (Skill)
Compatibility: Not stated.
This tool helps researchers organize long projects.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
install.sh:5 # curl -fsSL https://raw.githubusercontent.com/bd-loser/claude-code-termux/main/install.sh | bashClaude Code Termux (Skill)
Compatibility: Not stated.
This project allows you to use the Claude Code command line tool on your Android phone.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/validate.py:1055 if name in {".netrc", ".npmrc", "credentials.json", "id_dsa", "id_ecdsa", "id_ed25519Claude Codex Skills Assembly (Skill)
Compatibility: Not stated.
Reusable agent skills, deterministic activation, safety hooks, and installers for Claude Code and OpenAI Codex, with an agentskills.io-compatible skill surface.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_UNCONFIRMED
plugins/changelog-keeper/scripts/hook.py:55 out = subprocess.run(Claude Plugins (Plugin)
Compatibility: Not stated.
Git workflow discipline for teams working in Claude Code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
plugins/feature-loop/skills/feature-loop/scripts/log_run.py:44 proc = subprocess.run(["git", "-C", repo, "rev-Claude Skills (Plugin)
Compatibility: Not stated.
Skills personnels pour [Claude Code](https://claude.com/claude-code) , une famille cohérente qui couvre le cycle de vie complet d'une tâche de dev, du cadrage à la clôture.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
src/codex_wake/adapters.py:36 result = subprocess.run(command, capture_output=True, text=True, timeout=10)Codex Wake (Skill)
Compatibility: Not stated.
<h1 align="center">Codex Wake</h1>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
appearance-service.js:387 fs.rmSync(temporary, { force: true })Deepseek Pa Dsh Desktop (Skill)
Compatibility: Not stated.
[English](README.md) | [简体中文](README.zh-CN.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
determify/ast_scanner.py:631 # DET-07: Subprocess calls running agent CLIs (e.g. subprocess.run(["opencode", "determify (Skill)
Compatibility: Not stated.
Set up (with user consent) and execute the Determify CLI to audit codebases for deterministic AI waste (date math, file checks, JSON/YAML parsing, formatting, or ungated SDK calls), interpret findings, and collaboratively refactor code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_UNCONFIRMED OBFUSCATION_MINIFIED_PAYLOAD
.gitignore:9 .codex/Dialogue Trace (Skill)
Compatibility: Not stated.
Record and resume research questions, evidence and experiments across Codex tasks in explicitly registered local workspaces.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
skills/docforge/_shared/runtime/common/python/repo_identity.py:54 result = subprocess.run(docforge (Skill)
Compatibility: Not stated.
Writes new repository documentation from source-code evidence , catalog-driven, provenance-tracked, and independently audited.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.gitignore:25 id_rsa*Doubao Geo Skills (Skill)
Compatibility: Not stated.
一套面向中文内容运营者、本地商家和 B2B 营销团队的 GEO（生成式引擎优化）Skill 工具包，把客户资料整理、选题、写稿、平台改写和豆包检验串成可复用流程，减少重复整理，让内容生产与复盘有据可查。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST OBFUSCATION_MINIFIED_PAYLOAD
lib/client.js:106 const response = await fetch(SETTINGS_ROUTE, body === void 0 ? { credentials: "Dsh Paddleocr Skills (Skill)
Compatibility: Not stated.
English | [简体中文](README.zh-CN.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
skills/skillnotary/reference/capabilities.md:20 | `network` | `curl`, `wget`, `fetch()`, `axios`, `requests.*`Dsh Skillnotary (Skill)
Compatibility: Not stated.
**A DSH plugin that pins what your agent's skills are allowed to do , and tells you when that changes.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
evals/results/generic-v0.2-codex-answers-r2/records/routing-positive-refactoring.json:89 "command": "/bin/zshEvolve Software Architecture (Skill)
Compatibility: Not stated.
An agent Skill for evidence-based software architecture guidance.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
scripts/gen-skill-docs.ts:193 for (const file of obsolete) fs.rmSync(path.join(skillsDocDir, file));Flow Skills (Skill)
Compatibility: Not stated.
Portable, agent-agnostic workflow skills: plan, build, test, review, verify, orchestrate and ship.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_DOTENV OBFUSCATION_MINIFIED_PAYLOAD
.gitignore:5 .envfluid (Skill)
Compatibility: Not stated.
<p align="center"> <a href="https://fluid.plrstudio.fr"> <img src="assets/banner.svg" alt="fluid, production-grade UI for AI agents, minus the slop" width="100%"> </a> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/managed.ts:116 const response = await fetch(url, { signal: AbortSignal.timeout(120_000) });Google Workspace Agent Pack (Skill)
Compatibility: Not stated.
Private Google Workspace tooling for agents: a pinned managed `gws` CLI install, explicit human OAuth, offline/live diagnostics, portable Workspace skills, and optional MCP configuration templates.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
blueprint/hooks/safety-guard.sh:226 # curl/wget piped to shell (remote code execution)Gtm Os Kit (Skill)
Compatibility: Not stated.
<p align="center"> <img src="https://img.shields.io/badge/Claude_Code-Ready-blueviolet?style=for-the-badge" alt="Claude Code Ready" /> <img src="https://img.shields.io/badge/Skills-5_Included-orange?style=for-the-badge" alt="5 Skills" /> <img src="https://img.shields.io/badge/Plu
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED INSTALL_UNPINNED SECRETS_PATH_DOTENV
examples/changelog-forge/scripts/generate_changelog.py:61 proc = subprocess.run(How To Create A Skill Tutorial (Skill)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
install.sh:6 # curl -fsSL https://raw.githubusercontent.com/haidrrrry/humanize-ai-writing/main/install.sh | baHumanize Ai Writing (Skill)
Compatibility: Not stated.
Most AI writing services produce predictable text.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST
skills/ib-suite/scripts/bootstrap.py:168 shutil.rmtree(stale, ignore_errors=True)Ib Suite (Skill)
Compatibility: Not stated.
**English** | [简体中文](README.zh-CN.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
bin/jj-land:182 .env|.env.*|*.pem|*.key|*.p12|*.pfx|*.keystore|id_rsa*|id_dsa*|id_ecdsa*|id_ed25519*) note="seJj Agentic Workflow (Skill)
Compatibility: Not stated.
A practical methodology for running coding agents , including several in parallel , on [Jujutsu (jj)](https://github.com/jj-vcs/jj) repositories, without them destroying each other's work.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST
junyi-ai-weekly-review/scripts/collect.mjs:64 else if (entry.isFile() && /^chunk_\d+\.md$/.test(entry.name)) fJunyi Skills (Skill)
Compatibility: Not stated.
**Junyi’s AI Collaboration Skills**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
kevin-xhs-minitool-publisher/scripts/fetch_official_skill.py:39 with urllib.request.urlopen(request, timeout=6Kevinsu Skills (Skill)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES
starter-kit/tools/scrub_outbound.py:112 out = subprocess.run(["git", "diff", "--cached", "--name-only", "--difLucid Sheep Skill (Skill)
Compatibility: Not stated.
>
This grade is a hygiene screen, not proof of safety.
