Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 1 to 50 of 1,228 Grade D entries. Page 1 of 25.
Listed A to Z by name.
No entries match that filter.
Grade D, Two or more medium findings, or a high, Triangle
AGENT_HIDDEN_STEP
plugins/final/skills/final/SKILL.md:30 Don't tell the user a capability is missing until `find_tools` comes baFinal POS (MCP server)
Compatibility: Not stated.
Build custom POS, kiosk, self-checkout & in-person payment apps with AI agents on Final POS.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV +2 more
adapters/mcp/server.js:8 const response = await fetch(`${baseUrl}${path}`, options);AccordTrace (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.Kosta1985/accord-trace -->
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
docs/scripts/update_docs.py:36 result = subprocess.run(cmd, capture_output=True, text=True, cwd=cwd, check=Faladk (Skill)
Compatibility: Not stated.
A CLI for building, testing, and deploying PolyAI voice and chat agents.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +2 more
agent-hub-api/app/services/file_service.py:96 os.remove(db_file.path)Agent Hub (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK +4 more
capabilities/log/hook.mjs:121 await fs.unlink(lockPath);Agent Tools (Skill)
Compatibility: Not stated.
Reusable Agent Skills from agent-tools
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +2 more
banking/evals/run.py:59 result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)Agentfactory Business Plugins (Skill)
Compatibility: Not stated.
🚀 **Marketplace of domain-specific plugins for building enterprise AI agents.**
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES OBFUSCATION_MINIFIED_PAYLOAD
integrations/claude-code/acv_claude_bridge.py:62 run = subprocess.run(operation["argv"], cwd=cwd, shell=False,Ai Change Verification (Skill)
Compatibility: Not stated.
Vendor-neutral change verification with an optional trusted Claude Code provider.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +3 more
scripts/uninstall.js:8 await fs.rm(root, { recursive: true, force: true });Ai Dev Kit (Plugin)
Compatibility: Not stated.
Production-ready AI dev workflow scaffold with 59 skills, 33 agents, hooks, and rules for Claude Code, Codex, Gemini CLI, Copilot CLI, Qwen Code, and OpenCode.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
skill/ai-video-director/scripts/qwen3-voice-clone.py:102 subprocess.run(command, check=True)Ai Video Director Skill (Skill)
Compatibility: Not stated.
[English](README.en.md)
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK SECRETS_PATH_CREDENTIAL +1 more
evals/run-evals.ts:238 await Promise.all(workflowFiles.map((f) => fs.unlink(f)));ai.smithery/ImRonAI-mcp-server-browserbase (MCP server)
Compatibility: Not stated.
Automate cloud browsers to navigate websites, interact with elements, and extract structured data.…
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
package.json:24 prepareai.smithery/truss44-mcp-crypto-price (MCP server)
Compatibility: Not stated.
Provide real-time cryptocurrency price data and market analysis.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
packages/aicode-utils/src/utils/fsHelpers.ts:54 await fs.rm(filePath, { recursive: true, force: true });Aicode Toolkit (MCP server)
Compatibility: Not stated.
This repo provides:
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +3 more
src/aikito/add.py:262 shutil.rmtree(self.target_dir, ignore_errors=True)aikito (Skill)
Compatibility: Not stated.
<p align="center"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/lsaint/aikito/main/docs/assets/logo-dark.png"> <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/lsaint/aikito/main/docs/asset
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV +1 more
plugins/atkx/skills/skill-eval/references/static-checks.md:160 | `network` | a network call to a host the skilaiteamkit (Skill)
Compatibility: Not stated.
Twenty-five skills covering the software delivery lifecycle of a **company project team**.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
package.json:12 postinstallamp (MCP server)
Compatibility: Not stated.
> 🌏 **繁體中文說明：[README.zh-TW.md](./README.zh-TW.md)**
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
install.js:40 fs.unlink(dest, () => {});aphanis (Plugin)
Compatibility: Not stated.
🛡️ APHANIS :: Zero-Trust AI Provenance Firewall, Automatic Humanizer Engine & Stego Defense Platform
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
package.json:27 prepareapp.scfcontrolsplatform/mcp-server-scf (MCP server)
Compatibility: Not stated.
MCP server for the SCF Controls Platform , 187 tools for controls, evidence, risk, and TPRM.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +4 more
scripts/verify-kit.mjs:43 rejeita('recibo em falta', (d) => fs.rmSync(path.join(d, 'ancora/oro-v1.ots')));app.vercel.ora-x402-gateway/sensations-mergulho (MCP server)
Compatibility: Not stated.
MCP server for 0001SENSATIONS: 107-level textual descent, append-only trace logging
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
scripts/sync-skills.mjs:29 if (!check) fs.rmSync(path.join(targetRoot, rel));Apple Mail Mcp (MCP server)
Compatibility: Not stated.
Manage Apple Mail through natural language - read, search, send, and organize emails (macOS only)
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +3 more
scripts/broker-fixture-files.test.mjs:11 t.after(() => fs.rmSync(directory, { recursive: true, force: true }))Apple Notes Mcp (MCP server)
Compatibility: Not stated.
Manage Apple Notes through natural language - create, search, read, update, delete, and organize notes and folders (macOS only)
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
adapters/claude/skills/spec-converger/scripts/expression-outbound.mjs:345 response = await fetch(url, {Artifact Chain Assistant (Plugin)
Compatibility: Not stated.
Artifact-chain intake, review/repair/batch/audit workflows, diagnostics, hooks, and version-lock maintenance helpers.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
apps/mcp/server.py:24 result = subprocess.run(command, cwd=ROOT, text=True, capture_output=True, timeout=20)Awesome Codex App Template (Plugin)
Compatibility: Not stated.
<!-- Banner --> <div align="center"> <h1>Enterprise Monorepo Template</h1> <p><strong>Production-grade scaffold for multi-platform products.</strong><br>Next.js · Expo · macOS · FastAPI · MCP · AI SDK · Supabase , configured by a setup wizard in your browser.</p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST +2 more
scripts/check_release.py:82 commits = subprocess.check_output(beyondseo (Skill)
Compatibility: Not stated.
Audit websites, apply authorised SEO improvements and plan content, competitors and backlinks with evidence, design checks and optional project monitoring.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_HOST_FROM_INPUT +2 more
start.py:95 result = subprocess.run(Bidmaster Pro (Skill)
Compatibility: Not stated.
全流程 智能招投标 Agent：标书生成 · 招投标解读 · 标书检查 · 标书文档ai排版 · 商机发现 一键完成。 21 项合规检查 · 多模型切换 · RAG 知识库 · OCR 抽取。 从招标公告到可交付 docx 文档，全流程 AI 自动化。
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
package.json:71 prepareBounded Relay (Plugin)
Compatibility: Not stated.
<p align="center"> <img src="docs/assets/boundedrelay-cover.webp" alt="BoundedRelay , two AI workers connected through a policy gate" width="100%"> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
agent/src/skill.ts:224 uest|RestMethod)[^\n]{0,300}\|\s*(?:iex|Invoke-Expression)/i, severity: "critical", codBountyVerdict Agent Decision Tools (MCP server)
Compatibility: Not stated.
The button adds one free selector and six paid decision tools to VS Code.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +3 more
src/bruno/environment.ts:590 await fs.unlink(envFilePath);Bruno MCP Studio (MCP server)
Compatibility: Not stated.
**Turns an agent's API testing into files you keep: it authors and edits Bruno collections in place, then runs them , HTTP, WebSocket and gRPC, one identity or many , and reports per-request pass/fail you can re-run in CI.**
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +3 more
Labs/09_Framework_Interop_LangChain_LangGraph_CrewAI_n8n.ipynb:2016 " p = subprocess.Popen(\n",Building With Sarvam (Skill)
Compatibility: Not stated.
<!-- AIVidhya4Sarvam · Building with Sarvam -->
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
scripts/verify-server-json-version.ts:45 const downloadCmd = `curl -L "${downloadUrl}" | tar xz -C "${tmpDir}"Chrome Devtools Mcp (Plugin)
Compatibility: Portable across standard formats.
Control and inspect a live Chrome browser from your coding agent.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
package.json:19 prepareci.git/mymlh-mcp-server (MCP server)
Compatibility: Not stated.
OAuth-enabled MyMLH MCP server for accessing MyMLH data.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_UNNAMED_HOST +1 more
scripts/release/utils/command.js:16 * @param {object} options Options of `child_process.execFile()`, with `cwdckeditor (Plugin)
Compatibility: Portable across standard formats.
Install, configure, and integrate CKEditor 5 (free and premium) in any JavaScript project.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB +1 more
launcher/claudemax.win.js:432 fs.unlinkSync(tmp);Claude Code Workarounds (Plugin)
Compatibility: Not stated.
Unofficial community workarounds for Claude Code (empty thinking summaries; missing context-usage icon; no copy/paste of markdown).
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
scripts/bench-usages/oracles/python.py:4 files = subprocess.run(['git', '-C', root, 'ls-files', '*.py', '*.pyiClaude Db (Plugin)
Compatibility: Claude Code.
Free, open-source memory for Claude Code.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +2 more
plugins/panel-review/hooks/gate_lib.py:294 out = subprocess.run(Claude Plugins (Plugin)
Compatibility: Not stated.
The official Claude Code marketplace for [TruVerifAI](https://truverif.ai).
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +2 more
docs/preview-viewer.js:214 const res = await fetch(`/file?path=${encodeURIComponent(p)}`);Claw Hwp (Plugin)
Compatibility: Portable across standard formats.
AI(Claude·클로드 · Codex·코덱스)로 한글 문서(.hwp/.hwpx)를 한컴 없이 읽고·만들고·편집하는 오픈소스 스킬 · Read, create & edit Korean HWP in Claude/Codex
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST +5 more
benchmarks/run_benchmark.py:86 subprocess.run(Code Context Engine (MCP server)
Compatibility: Not stated.
Save 94% on AI coding tokens.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +3 more
python-sdk/codepathfinder/dataflow.py:184 ... to_sinks=calls("os.system", "subprocess.call"),Code Pathfinder (MCP server)
Compatibility: Not stated.
<div align="center"> <img src="./assets/banner.png" alt="Code Pathfinder - Open-source SAST with cross-file dataflow analysis" width="100%"> </div>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
plugins/code2manual/skills/code2manual/scripts/inspect_repo.py:295 completed = subprocess.run(Code2Manual (Plugin)
Compatibility: Not stated.
> Chinese documentation: [README.zh-CN.md](README.zh-CN.md)
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
cmd/codehelper/update.go:145 build := exec.Command("go", args...)Codehelper (MCP server)
Compatibility: Not stated.
**Local-first repo intelligence for AI coding assistants.**
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/build_windows_launcher.py:36 subprocess.run(Codex Trajectory (Plugin)
Compatibility: Codex.
Privacy-aware trajectory viewer for local Codex task logs
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV +1 more
src/release-discovery.mjs:449 response = await fetch(current, { headers: headersForUrl(headers, current, netwoCodexless (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV +2 more
cli/commands/index.py:219 display.console.print(f" curl {_get_url()}/health | jq '.indexer'")com.knitli/codeweaver (MCP server)
Compatibility: Not stated.
Public repository knitli/codeweaver.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
package.json:27 preparecom.mux/mcp (MCP server)
Compatibility: Not stated.
You can run the MCP Server directly via `npx`:
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
package.json:16 preparecom.presscart/presscart (MCP server)
Compatibility: Not stated.
The official [Model Context Protocol](https://modelcontextprotocol.io) server for [Presscart](https://www.presscart.com), a marketplace for disclosed paid editorial placements across 1,700+ publications.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
src/tools/media.test.ts:613 await fs.rm(dir, { recursive: true, force: true });com.socialneuron/mcp-server (MCP server)
Compatibility: Not stated.
91 public stdio MCP tools for creating, scheduling, and analyzing social content through Social Neuron.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
package.json:22 preparecom.xcodebuildmcp/XcodeBuildMCP (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server and CLI that provides tools for agent use when working on iOS and macOS projects.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +2 more
__init__.py:563 result = subprocess.run(concierge (MCP server)
Compatibility: Not stated.
🚀 Universal SDK for building next-gen MCP servers
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
config-drift-checker/tools/cc-release.mjs:43 const cleanup = () => fs.rm(prefix, { recursive: true, force: truConfig Drift Checker (Plugin)
Compatibility: Not stated.
CI for your coding-agent setup (CLAUDE.md, skills, hooks): pinned baselines, a canary on every Claude Code release, model and version matrix, context-cost drift, self-diagnosing reports, repair.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST +1 more
scripts/_common.py:382 subprocess.check_call(contentforge (Plugin)
Compatibility: Portable across standard formats.
An open-source editorial production system that researches, verifies, drafts, and delivers publication-ready long-form content with human review and provenance built in.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_UNCONFIRMED +2 more
scripts/dmarc.mjs:47 fetch(`https://api.cloudflare.com/client/v4${path}`, {Crosby, TX Weather (MCP server)
Compatibility: Not stated.
Crosby, TX weather, air quality, tropics, floods, fishing, pollen, burn bans, radar, news & schools.
This grade is a hygiene screen, not proof of safety.
