Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 401 to 450 of 3,335 Grade C entries. Page 9 of 67.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES SECRETS_PATH_DOTENV
omnimodal/audio_processing.py:111 result = subprocess.run(Deepseek Omnimodal (Plugin)
Compatibility: Not stated.
Open-source multimodal MCP plugin for text-only AI agents: recognize and generate images, video, and audio through Qwen/DashScope.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
core/config-history.js:45 for(const f of files.slice(200)) fs.rmSync(path.join(d,f.n),{force:true});deliberation (MCP server)
Compatibility: Not stated.
Use when you want a delegated second opinion or implementation from GPT (Codex), Gemini, Grok (xAI), or OpenRouter (config-driven, 400+ models) - seven expert subagents (Architect, Plan Reviewer, Scope Analyst, Code Reviewer, Security Analyst, Researcher, Debugger) and bundled as
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:6 postinstallDemo Video Factory (Plugin)
Compatibility: Not stated.
Turn any SaaS URL into a ~26s branded product-demo video , brand-matched scenes, a recreated product-UI 'wow' scene, real screenshots, and a soundtrack.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
.github/workflows/validate.yml:75 code = subprocess.run(["curl", "-s", "-o", "/dev/null", "-w", "%{http_code}"den Korean AEC knowledge, curated (MCP server)
Compatibility: Not stated.
Curated Korean AEC expertise for AI agents: KDS·KCS·KS, building law, practice, and the reasoning.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
hooks/dep-guard.py:44 result = subprocess.run(Dep Guard (Plugin)
Compatibility: Not stated.
Dependency guardian , intercepts package installs to enforce latest versions and block vulnerable packages.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/cli.js:130 const response = await fetch(url, { ...init, headers: { Accept: "application/json", ...init.heaDeploy to Agents (MCP server)
Compatibility: Not stated.
Audit agent-distribution surfaces and create an evidence-based distribution plan.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
package.json:12 prepareDeploygate Agent Plugin (Plugin)
Compatibility: Not stated.
DeployGate integration for Claude Code and Codex
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
scripts/doctor.sh:47 ping_response=$(curl -sS -m 10 -X POST "${DAEMON_URL}/json_rpc" \DERO MCP Server (MCP server)
Compatibility: Not stated.
Query the DERO privacy blockchain and its documentation through the dero-mcp-server.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
evals/real-world/cluster-gpu-monitor/input/compose.yaml:99 response = urllib.request.urlopen('http://127.0.0.1Deslop Gpt (Skill)
Compatibility: Not stated.
Test-first, evidence-backed cleanup for accumulated test, verification, and fallback bloat.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES SECRETS_PATH_DOTENV
evals/_harness/run_skill.py:75 proc = subprocess.run(Dev Event Organizer Skills (Skill)
Compatibility: Not stated.
Skills for technical event operations , conferences, meetups, hackathons, and community programs covering strategy, speakers, sponsors, programming, day-of production, and post-event learning.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:18 preparedev.ezstat/ezstat-mcp-server (MCP server)
Compatibility: Not stated.
A standalone [Model Context Protocol](https://modelcontextprotocol.io) server for [EzStat](https://ezstat.dev).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
examples/programmatic-usage.ts:34 // --- Resilient fetch (SSRF-guarded, retry, timeout) ---dev.forgesworn/402-mcp (MCP server)
Compatibility: Not stated.
**Nostr:** [`npub1mgvlrnf5hm9yf0n5mf9nqmvarhvxkc6remu5ec3vf8r0txqkuk7su0e7q2`](https://njump.me/npub1mgvlrnf5hm9yf0n5mf9nqmvarhvxkc6remu5ec3vf8r0txqkuk7su0e7q2)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
packages/core/src/ktx2.ts:106 await fs.rm(workDir, { recursive: true, force: true });dev.glbforge/glbforge (MCP server)
Compatibility: Not stated.
**glbforge.dev** · raw AI mesh in, shipped asset out
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB
client/index.ts:99 const res = await fetch(`${this.baseUrl}${path}`, {dev.veritap/agent-memory (MCP server)
Compatibility: Not stated.
**Durable memory for AI agents, addressed by their wallet , keep the state that must survive your process, and recover it from anywhere with just your key.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
scripts/reset-database.js:26 fs.unlinkSync(dbPath);Devmind Mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_MINIFIED_PAYLOAD
skills/diagram-skills/scripts/diagram_skills.py:1416 lines.append('.lane-box{fill:var(--surface);stroke:var(--Diagram Skills (Skill)
Compatibility: Not stated.
<p align="center"> <img src="skills/diagram-skills/assets/icon.svg" width="88" alt="DiagramSkills mark"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST OBFUSCATION_MINIFIED_PAYLOAD
docs/STATUS.md:327 > Perplexity path **skips** the re-fetch (its URLs are already grounded → no added latency)diffmode_free (Plugin)
Compatibility: Not stated.
Free guerrilla growth tactics for startups, the kind your competitors won't come up with on their own.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
bin/setup-dragonscale.sh:108 if command -v curl >/dev/null 2>&1; thenDigital Brain (Skill)
Compatibility: Not stated.
Claude + Obsidian knowledge companion.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
server/digits_server.py:55 proc = subprocess.run(Digits (Plugin)
Compatibility: Not stated.
Digits: connect Claude to Apple Numbers.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
examples/todos/native-appearance.ts:106 const server = Bun.serve({ hostname: "127.0.0.1", port, async fetch(redirect (Skill)
Compatibility: Not stated.
> 🎯 Direct gives each state of your app its own URL.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
package.json:20 postinstallDiscogs Mcp (MCP server)
Compatibility: Not stated.
A powerful **Model Context Protocol (MCP) server** that enables AI assistants to interact with your personal Discogs music collection.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST +1 more
src/cli.ts:1077 fs.rmSync(path.join(npxDir, entry), { recursive: true, force: true });Discord Mcp (MCP server)
Compatibility: Not stated.
**Manage your entire Discord server from Claude Code, Claude Co-Work, Claude Desktop, Cursor, or Windsurf.** 139 admin tools across 20 categories , roles, channels, members, messages, threads, moderation, forums, stages, webhooks, events, polls, DMs, and more.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
.mcpregistry_registry_token:1 {"token":"eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJtY3AtcmVnaXN0cnkiLCJleDiscrete Structures (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
skills/disk-space-analyzer/scripts/macos/list_volumes.py:20 out = subprocess.check_output(Disk Space Analyzer Skill (Skill)
Compatibility: Not stated.
Claude Code Skill for analyzing disk space and finding cleanable files.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
cmd/decionis/governcmd.go:149 child := exec.Command(command[0], command[1:]...)docker (MCP server)
Compatibility: Not stated.
<!-- Badge sweep 2026-08-18: every URL below verified HTTP 200 (rules/discovery.rules.md Rule 1.1), with two branch-lifecycle caveats that resolve at merge: the actions.yml badge endpoint registers when the workflow reaches the default branch (this README publishes in the same me
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skills/container-debugging/SKILL.md:111 wget -qO- http://db:5432 || echo "connection refused or timeout"Docker Developer Tools (Plugin)
Compatibility: Not stated.
Cursor IDE plugin for Docker workflows.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:21 prepareDocusign Navigator (MCP server)
Compatibility: Not stated.
Secure Docusign Navigator integration for AI assistants to access and analyze agreement data.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skills/yd-frontend-build/scripts/check_bundle.py:43 # JS 호출: fetch("..."), import("..."), importScripts("...")Doksam Skills (Skill)
Compatibility: Not stated.
Claude Code·Codex·Antigravity 에서 쓰는 Agent Skill 25개입니다.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_UNNAMED_HOST
src/install.ts:557 if (!dry) fs.rmSync(path.join(d, e.name), { force: true });dolly (Plugin)
Compatibility: Not stated.
Long-term memory + feature planning for coding agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
mcp-servers/domino_mcp_server/domino_mcp_server.py:72 resp = requests.get("http://localhost:8899/access-token"dominodatalab (Plugin)
Compatibility: Not stated.
Full Domino Data Lab platform support , workspaces, jobs, model deployment, experiment tracking, GenAI tracing, Spark/Ray/Dask, and app deployment for data science teams
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL
opencode/dotnet-episteme.js:24 * `git diff && curl x` matches `git diff*` but the later `*&*` deny wins.Dotnet Episteme Skills (Plugin)
Compatibility: Not stated.
DotNet Episteme Skills - a curated, manual-first .NET AI skills library rooted in systematic knowledge (episteme) and shaped by disciplined craft (techne), designed for engineers who prioritise precision over hype.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
hooks/douchebag-activate.js:16 try { fs.unlinkSync(flagPath); } catch (e) {}douchebag (Plugin)
Compatibility: Not stated.
Turns your coding agent into a loud vulgar gym-bro chad.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
package.json:20 prepareDr Mcp (MCP server)
Compatibility: Not stated.
Clean your MCPs.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
scripts/verify_capture.py:62 result = subprocess.run(command, capture_output=True, text=True)Draw Ui (Skill)
Compatibility: Not stated.
UI design & mockup skill for Claude Code & Codex, from screenshot to code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST OBFUSCATION_MINIFIED_PAYLOAD
skills/drawio-skill/scripts/aiicons.py:87 def fetch(url):Drawio Skill (MCP server)
Compatibility: Not stated.
Agent skill that turns natural language, code, Terraform/K8s, SQL, OpenAPI, AsyncAPI, Protobuf and GraphQL sources into editable, tested draw.io architecture diagrams: incremental sync, multi-view projection, drift diff, CI architecture tests, whiteboard derasterize, interactive
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
electron/storage/sqlite-manager.js:234 fs.unlinkSync(targetPath);drawio2go (MCP server)
Compatibility: Not stated.
<img width="250px" src="public/icon/logo.svg" align="left"/>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
src/diff.ts:101 fs.rmSync(tmp, { recursive: true, force: true });driftlint (Skill)
Compatibility: Not stated.
**Your CLAUDE.md is lying to your agent.** driftlint keeps agent context files true, two ways: a **drift linter** that finds the claims in `CLAUDE.md`, `AGENTS.md`, skills, subagents and cursor rules that your code no longer supports , and **Reviewed Memory**, the missing approv
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/install.sh:2 # ds-rescue installer - curl this from README quickstartDs Rescue Cc (Plugin)
Compatibility: Not stated.
Let your claude-code get second opinion and review cc execution results from Deepseek
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
lib/client.js:250 const response = await fetch(API + path, { cache: 'no-store' });Dsh Chatgpt Bridge (MCP server)
Compatibility: Not stated.
> **Let ChatGPT drive your local DSH agents.** > > 在 ChatGPT 里创建任务、继续会话、监督 Goal、处理审批并检查结果，不用在 ChatGPT 和 DSH 之间反复复制 Prompt。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
package.json:190 prepareDsh Mcp Panel (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:95 prepareDsh Tool Chaos (Plugin)
Compatibility: Not stated.
> Development version `0.1.0-next.1` (GitHub source; no npm release): tested locally on Windows Node.js 24.11.1 with DSH `0.1.7-rc.2` (2026-09-28).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
src/duckdb_mcp_server/config.py:28 """Named AWS profile from ~/.aws/credentials. If None, the automatic credenDuckdb Mcp Server (MCP server)
Compatibility: Not stated.
A [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server that gives AI assistants full access to [DuckDB](https://duckdb.org/) , query local files, S3 buckets, and in-memory data using plain SQL.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
scripts/build_learning_example.py:21 run = subprocess.run([sys.executable, '-B', '-X', 'utf8', str(CORE / 'tooDuya Skills (Skill)
Compatibility: Not stated.
墨涅斯的商业与线索获客：主入口、12项业务快捷方式、选题与短视频生产新流程、一句话更新、24篇知识、真实模板MCP与本地项目记忆。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:42 prepareDynatrace Managed Mcp (MCP server)
Compatibility: Not stated.
Query logs, metrics, events, entities, problems, security vulnerabilities and SLOs from self-hosted Dynatrace Managed clusters, across one or many environments.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
scripts/fetch-docs.ts:5 const files = await fetch(e18e (MCP server)
Compatibility: Not stated.
MCP server that flags inefficient or outdated npm packages and serves migration docs.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zs8EIrvg0" style="display:none">Z09B3Ug2IIOzAXGx7BbNR/rrXDf3S7Kowbzra16JkkdRUk3XSiZn+epMEasel Js Cpu Render Kit (Plugin)
Compatibility: Not stated.
Imagine a world where your AI coding assistant, whether Claude, Codex, Copilot, or OpenCode, can render complex visual applications directly in the browser, without a single GPU call.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:23 prepareEasyparser Amazon Product & Seller Data (MCP server)
Compatibility: Not stated.
Real-time Amazon product, seller, and search data for AI agents across 21 marketplaces.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/edinet_mcp/_cache.py:105 shutil.rmtree(self._dir)Edinet Mcp (MCP server)
Compatibility: Not stated.
EDINET XBRL parsing library and MCP server for Japanese financial data.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_DOTENV OBFUSCATION_MINIFIED_PAYLOAD
plugins/twitter-voice/skills/twitter-voice-setup/scripts/check_env_keys.py:32 env_path = Path.home() / ".env"Eidolon Cache (Plugin)
Compatibility: Not stated.
<p align="center"> <img src="assets/image/hero_A_hand_of_words.png" alt="Two hands touching on wrinkled linen at golden hour , one small and feminine, palm up; the other covering it gently, dissolving into handwritten cursive script and warm amber light where they meet."> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
scripts/ensure-electron.mjs:49 fs.rmSync(target, { recursive: true, force: true });Electron Mcp Server (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/logo.png" alt="Electron Debug MCP" width="180" height="180" /> </p>
This grade is a hygiene screen, not proof of safety.
