Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 301 to 350 of 3,335 Grade C entries. Page 7 of 67.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST
docs/site.js:72 fetch(brainEl.getAttribute("data-brain"))Codex Council (Plugin)
Compatibility: Not stated.
Codex Council adapts the LLM Council method to Codex-only workflows: five independent council roles, compact role outputs, anonymized review, rubric scoring, dissent capture, and chairman synthesis for implementation decisions.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/package.py:40 "id_rsa",Codex Council (Plugin)
Compatibility: Not stated.
Codex Council is a Codex-native workflow for pressure-testing consequential decisions, engineering tradeoffs, research interpretations, and explicitly requested council code reviews.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
skills/dsh-web/scripts/dsh_client.py:172 result = subprocess.run(Codex Dsh Web (Plugin)
Compatibility: Not stated.
English | [简体中文](README_CN.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST
plugins/codex-dynamic-bridge/bridge/companion.py:269 shutil.rmtree(stage, ignore_errors=True)Codex Dynamic Bridge (Plugin)
Compatibility: Not stated.
[中文](#中文) | [English](#english)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES
src/codex_fast_proxy/benchmark.py:840 completed = subprocess.run(Codex Fast Proxy (Skill)
Compatibility: Not stated.
Codex App auth-split proxy for third-party OpenAI-compatible APIs.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/codex_fewer_permission_prompts/cli.py:35 "id_rsa",Codex Fewer Permission Prompts (Plugin)
Compatibility: Not stated.
Safe Codex Agent Skill for reducing repeated permission prompts with verified prefix_rule proposals, dry-run apply, and rollback.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
code/codex-flight-control/src/persistence/mission-contract-repository.ts:254 const command = commands.get(entrCodex Flight Control (Plugin)
Compatibility: Not stated.
面向 Codex 的生产级自主编程飞控：先把需求变成可持续文档，再把大目标拆成可验证的 Wave，以机械门禁、持久状态、一层子代理和动态战术指导约束长期开发。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
labs/incident-response-benchmark/evaluator.py:139 with urllib.request.urlopen(req, timeout=3) as response:Codex Howto (Plugin)
Compatibility: Not stated.
Engineering-first OpenAI Codex guide: 14 modules, 9 installable skills, reproducible benchmarks, testing, review, orchestration, and a Living Wiki.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
plugin/network-state-closeout/skills/initialize-network-state/references/discovery-guide.md:39 Useful local soCodex Knows Your Network (Plugin)
Compatibility: Not stated.
**English** | [简体中文](README.zh-CN.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST OBFUSCATION_MINIFIED_PAYLOAD
codex-cn-launcher.mjs:216 const response = await fetch(url);Codex Marketplace Zh (Plugin)
Compatibility: Not stated.
Codex 插件市场中文化 / Codex Plugin Marketplace Chinese , 翻译插件名称、分类和简介并对齐布局。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
plugins/codex-native-long-video-memory/evals/generate_visual_fixture.py:110 subprocess.run(Codex Native Long Video Memory (Plugin)
Compatibility: Not stated.
<p align="center"> <img src="./assets/codex-native-long-video-memory-cover.jpg" alt="A dark evidence-first video timeline connected to a local memory graph" width="100%"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
plugins/codex-obsidian-memory/scripts/memory_core.py:108 completed = subprocess.run(Codex Obsidian Memory (Plugin)
Compatibility: Not stated.
Local-first, branch-aware long-term memory for Codex, backed by Obsidian.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
plugins/codex-plugin-discovery/skills/codex-plugin-discovery/scripts/build_index.py:40 result = subprocess.runCodex Plugin Discovery (Plugin)
Compatibility: Not stated.
Codex Plugin Discovery is a Codex skill that helps find task-relevant Codex plugins from two official OpenAI plugin repositories:
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
plugins/task-completion-guard/scripts/review_snapshot.py:86 process = subprocess.Popen(Codex Plugins (Plugin)
Compatibility: Not stated.
Codex plugins for reliable, evidence-backed task completion.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
package.json:14 installCodex Reasoning Sidebar (Plugin)
Compatibility: Not stated.
> Codex 实时思维链侧边栏插件：在 Codex 内置浏览器的侧边栏中，流式显示当前窗口的思考过程。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
plugins/remote-ssh/scripts/remote-ssh-cli.js:30 const sshHost = (await rl.question("SSH Host (user@hostname orCodex Remote Ssh (Plugin)
Compatibility: Not stated.
Remote SSH plugin for OpenAI Codex with MCP tools, host policies, audit logging, and safe remote operations.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_DOTENV OBFUSCATION_MINIFIED_PAYLOAD
src/install.ts:565 ".sdlc/policies/**", ".sdlc/schemas/**", ".sdlc/workflows/**", ".sdlc/templates/**", ".env"Codex Sdlc (Plugin)
Compatibility: Not stated.
Turn one feature request into a coordinated Codex delivery workflow: requirements, implementation, independent QC, and human acceptance.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
packages/plugin/internal/rename/app_server.go:100 cmd := exec.CommandContext(ctx, config.CodexPath, args...)Codex Session Auto Rename (Plugin)
Compatibility: Not stated.
> [!WARNING] > **This does not work properly yet.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
plugins/codex-site/skills/codex-site/scripts/check-site.mjs:10 'wrangler.jsonc', '.npmrc', '.pypirc', '_workerCodex Site (Plugin)
Compatibility: Not stated.
**说出想法，把第一个网站做出来、发出去、继续改。**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST OBFUSCATION_MINIFIED_PAYLOAD
.agents/skills/sol-luna-orchestration/scripts/orchestration-dashboard.mjs:87 on action(payload){const responseCodex Skill (Plugin)
Compatibility: Not stated.
This repository adds a dependency-free orchestration layer to Codex.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
claude-fix-unicode-decode/SKILL.md:45 result = subprocess.run(Codex Skills (Plugin)
Compatibility: Not stated.
分享一些好用的codex-skill与claude-skill
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
skills/usage-report/scripts/test_usage_report.py:495 completed = subprocess.run(Codex Usage Audit (Plugin)
Compatibility: Not stated.
Local token, context, cache, and cost telemetry for Codex conversations.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
plugins/codex-usage-reports/lib/codex_usage_reports/update_notice.py:94 with urllib.request.urlopen(request, tCodex Usage Reports (Plugin)
Compatibility: Not stated.
Automatic local token usage reports for every Codex Task and turn.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
src/dependencies.ts:220 fs.unlinkSync(zipFile);Codex Wakatime (Plugin)
Compatibility: Not stated.
Codex plugin for Wakatime
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
docs/details/wsl-output-encoding.md:19 The variable is passed through `child_process.spawn` and does not modifCodex Win To Wsl (Plugin)
Compatibility: Not stated.
Reliable WSL command execution for Windows-native Codex, with strict cwd handling, structured results, UTF-8 output, timeouts, and process cleanup.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
src/auth/store.ts:266 fs.rmSync(file, { force: true });Codex With Chatgpt (MCP server)
Compatibility: Codex.
ChatGPT thinks.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES
scripts/install-hook-runtime.py:434 shutil.rmtree(temporary, ignore_errors=True)Codex Work Governance (Plugin)
Compatibility: Not stated.
Composable, tool-neutral governance policies for Codex work.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_MINIFIED_PAYLOAD
mcp/lib/report.mjs:37 :root{color-scheme:dark;--bg:#11100f;--card:#1d1b19;--line:#38332f;--text:#f6f2ed;--muteCodex Workflows (Plugin)
Compatibility: Not stated.
Codex Workflows is a Codex plugin for persistent, budgeted multi-agent orchestration.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
scripts/test_youtube_mcp.py:586 completed = subprocess.run(Codex Ymt (Plugin)
Compatibility: Not stated.
Open-source Codex plugin and MCP server for translating YouTube video titles and descriptions, reviewing multilingual metadata, and safely publishing approved localizations.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
evals/run_apply_behavior_smoke.py:93 completed = subprocess.run(CodexQB (Plugin)
Compatibility: Codex.
CodexQB is a Codex plugin for evidence-backed repo comprehension, planning, QA audit, and gated implementation handoffs.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:20 prepareCoding Agents Tmux (Plugin)
Compatibility: Not stated.
Track, monitor, and jump between agent sessions in tmux
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
src/colab_mcp/server.py:17 os.environ.get("COLAB_MCP_GOOGLE_CREDENTIALS", "~/.config/colab-mcp/credentials.jsoColab Drive MCP (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.YummyTastyCode/colab-drive-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED NETWORK_NO_FIXED_HOST
package.json:35 preparecom.blackwalltier/blackwall (MCP server)
Compatibility: Not stated.
API-key pre-action risk gate: any irreversible agent action (money, SQL, delete, email).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:21 preparecom.clicksend/clicksend-mcp-server (MCP server)
Compatibility: Not stated.
MCP for ClickSend.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.agents/skills/update-cli-version/SKILL.md:32 curl --proto '=https' --tlsv1.2 -fsSL \com.codescene/codescene-mcp-server (MCP server)
Compatibility: Not stated.
An MCP server that provides CodeScene Code Health analysis tools.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
src/oauth.ts:186 const res = await fetch(`${base}/v1.18/teamBoard/list`, {com.dragapp/mcp-server (MCP server)
Compatibility: Not stated.
AI-powered email & WhatsApp for teams , manage your shared inbox from Claude, Cursor or ChatGPT.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:33 preparecom.easyonward/mcp-server (MCP server)
Compatibility: Not stated.
Passport visa, entry & transit requirements for any country pair, with official government sources.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
lib/credentialStore.js:110 try { fs.unlinkSync(f); } catch { /* already gone */ }com.freeelatech/oneda (MCP server)
Compatibility: Not stated.
Persistent, governed institutional memory for Claude Code , specs, decisions, learnings.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
src/auth/TokenManager.ts:102 fs.unlinkSync(this.tokenFile);com.gitscrum/mcp (MCP server)
Compatibility: Not stated.
MCP server for GitScrum , manage tasks, sprints, time tracking, and client workflows via AI
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
scripts/backfill-filecoin.ts:56 const res = await fetch(url);com.hekkova/mcp (MCP server)
Compatibility: Not stated.
TPermanent memory layer for AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.gitignore:8 credentials.jsoncom.htagai/htag-docs (MCP server)
Compatibility: Not stated.
Public HTAG discovery for MCP tools, API endpoints, OpenAPI ops, and agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
scripts/schema_drift.py:71 raw = subprocess.run(com.longbridge/mcp (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="https://raw.githubusercontent.com/longbridge/longbridge-mcp/main/docs/logo.png" alt="Longbridge" width="120" height="120"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
package.json:17 preparecom.lyrenth/lyrenth-mcp (MCP server)
Compatibility: Not stated.
Read the content of one or many public web pages through Lyrenth, as clean Markdown instead of raw HTML.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
desktop/src-tauri/icons/build_icons.py:51 os.remove(out_png)com.mangofolio/investbrain (MCP server)
Compatibility: Not stated.
> 有经验投资者的纪律自主工具，解决"知行合一"问题 > **不是投顾，不给建议，而是"镜子" + "纪律锚点"**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
mireye_earth_mcp/onboarding.py:48 home / ".config" / "mireye-mcp" / "credentials.json"com.mireye/earth (MCP server)
Compatibility: Not stated.
<!-- mcp-name: com.mireye/earth -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
package.json:36 @clerk/nextjscom.onkernel/kernel-mcp-server (MCP server)
Compatibility: Not stated.
A [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server that provides AI assistants with secure access to [Kernel platform](https://onkernel.com) tools and browser automation capabilities.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
being-exec/install.sh:44 curl -sSL "$BINARY_URL" -o "$TMP"com.ruddia/being-mcp-server (MCP server)
Compatibility: Not stated.
**Personality Runtime for AI** , give any AI its own personality, memory, and identity.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:25 postinstallcom.runmemento/memento (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="docs/assets/memento-banner.png" alt="Memento" width="540"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/intent/empty-document.test.ts:71 await fs.rm(dir, { recursive: true, force: true });com.seanwinslow/intent-engineering (MCP server)
Compatibility: Not stated.
`intent-engineering` is an MCP server that exposes three tools , `audit_intent_spec`, `generate_intent_spec_scaffold`, and `assess_retrofit_level` , letting any MCP-aware client (Claude Desktop, Cursor, Anti-Gravity) review, scaffold, and triage agent intent specs against a 9-s
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:22 preparecom.sportwizzard/sportwizzard (MCP server)
Compatibility: Not stated.
Query live sports-betting data , **odds, player props, +EV edges, arbitrage, stats and reference data** from 35+ sportsbooks and DFS apps , from any MCP-capable AI agent (Claude Code, Claude Desktop, Codex, Cursor, …).
This grade is a hygiene screen, not proof of safety.
