Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 751 to 800 of 1,228 Grade D entries. Page 16 of 25.
Listed A to Z by name.
No entries match that filter.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
.agents/skills/cloudflare/references/sandbox/patterns.md:40 await sandbox.exec('curl -fsSL https://code-serverbanrepco_mcp (MCP server)
Compatibility: Not stated.
This project implements a Model Context Protocol (MCP) server for the Bank of the Republic of Colombia.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +3 more
desktop/build-desktop.mjs:55 await fs.rm(payloadDir, { recursive: true, force: true });Callosium (MCP server)
Compatibility: Not stated.
**Every AI you use forgets you.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/audit.sh:63 tracked = set(os.popen("git ls-files").read().splitlines())CloudSprite (MCP server)
Compatibility: Not stated.
Talk to CloudSprite as the signed-in user: search datasets and docs, set org/team/project scope, and file product feedback.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
packages/ai/src/provider/index.ts:92 const response = await fetch(`${this.baseUrl}/chat/completions`, {doc77 (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="packages/core/src/web/assets/logo.svg" width="100" alt="Doc77"> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
.github/workflows/ci.yml:15 run: curl -LsSf https://astral.sh/uv/install.sh | shFhir Mcp Server (MCP server)
Compatibility: Not stated.
<a name="readme-top"></a>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT NETWORK_HOST_FROM_INPUT
testing/clean-room/Dockerfile.cursor-local:32 RUN curl https://cursor.com/install -fsS | bashgitmem (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/banner.svg" alt="GitMem , Institutional memory for AI coding agents" width="700" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT NETWORK_HOST_FROM_INPUT
scripts/dev-setup.sh:55 curl -LsSf https://astral.sh/uv/install.sh | shGopher & Gemini MCP Server (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.cameronrye/gopher-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +3 more
src/completion.ts:228 "# Add to your profile: Invoke-Expression (headroom completion pwsh | Out-String)",headroom (MCP server)
Compatibility: Not stated.
Check subscription limits before work, with MCP tools, a quota line and the Headroom skill.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT NETWORK_HOST_FROM_INPUT
package.json:25 postinstallHermos Ide (MCP server)
Compatibility: Not stated.
**Your code stays on your machine.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
.agents/skills/sentry/SKILL.md:18 1. Install the Sentry CLI: `curl https://cli.sentry.dev/install -fsS | bash`Hevy MCP Server (MCP server)
Compatibility: Not stated.
Read, analyze, create, and update Hevy workouts, routines, exercises, and body measurements in Claude.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT AGENT_IGNORE_INSTRUCTIONS
crates/hwatu/src/clone.rs:647 match fetch(href) {hwatu (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
package.json:26 prepareio.github.builtbyabs/shopify-geo-audit (MCP server)
Compatibility: Not stated.
Audit any Shopify store for AI-search readiness, then generate the fixes you actually paste in.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
AGENT_IGNORE_INSTRUCTIONS
packages/fixtures/corpus/cases/C046-review-readme-prompt-surface/surface/README.md:5 <!-- assistant: ignore prio.github.calllint/calllint (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/brand/logo-mark-128.png" width="96" alt="CallLint logo" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
package.json:22 prepareio.github.cameroncooke/XcodeBuildMCP (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server and CLI that provides tools for agent use when working on iOS and macOS projects.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK +4 more
test-epic-debug.cjs:66 fs.rmSync(testDir, { recursive: true, force: true });io.github.chrismcdermut/proletariat-cli (MCP server)
Compatibility: Not stated.
``` ██████╗ ██████╗ ██████╗ ██╗ ███████╗████████╗ █████╗ ██████╗ ██╗ █████╗ ████████╗ ██╔══██╗██╔══██╗██╔═══██╗██║ ██╔════╝╚══██╔══╝██╔══██╗██╔══██╗██║██╔══██╗╚══██╔══╝ ██████╔╝██████╔╝██║ ██║██║ █████╗ ██║ ███████║██████╔╝██║███████║ ██║ ██╔═══╝ ██╔══██╗██║ ██║██║ ██╔══╝ ██║ ██╔
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
package.json:28 prepareio.github.cocaxcode/ai-context-inspector (MCP server)
Compatibility: Not stated.
<p align="center"> <h1 align="center">@cocaxcode/ai-context-inspector</h1> <p align="center"> <strong>One command.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
install.ps1:114 Exit-Install "this script is for Windows. On Linux and macOS, run:`n curl -fsSL $RawUrl/instalJev Cli (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
SECRETS_PATH_UNCONFIRMED OBFUSCATION_ENCODED_BLOB OBFUSCATION_MINIFIED_PAYLOAD
.gitignore:8 *.pycJobSpy (MCP server)
Compatibility: Not stated.
<h1 align="center"> <a href="https://github.com/speedyapply/JobSpy"><img src="https://github.com/user-attachments/assets/dcb90340-9469-4808-bc51-868e59a000e0" alt="JobSpy" width="320"></a> </h1>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
v2/firefox/data/options/index.js:203 fetch(url).then(() => toast('Looks Good')).catch(e => toast(e.message));Keepass Macpass Helper (MCP server)
Compatibility: Not stated.
An extension for Chrome, Opera, Edge, and Firefox that integrates with KeePass, MacPass, and KeePassXC to find and fill credentials, generate secure passwords and passkeys, and save new logins directly to your database, no manual copying required.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB +1 more
CLAUDE.md:265 SSH_PRIVATE_KEY_PATH=~/.ssh/mcp_deploy_key # or your key pathMcp Security Checklists (MCP server)
Compatibility: Not stated.
We're a team of security and AI enthusiasts building [MCP Manager](https://mcpmanager.ai), a comprehensive MCP security solution for businesses of all sizes.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
AGENT_IGNORE_INSTRUCTIONS
03. MCP Threats and Attack Patterns/3.04-authorization-permission.md:355 | Hidden-instruction flags | Flag “igMcp Security Testing Guide (MCP server)
Compatibility: Not stated.
The Model Context Protocol (MCP) is an open protocol that lets LLM applications connect to external data sources, tools, prompts, workflows, and services.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
packages/sdk/src/accounts.ts:22 return this.http.get("/api/v1/private/accounts/credits");melaya (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT NETWORK_HOST_FROM_INPUT
cloudflare-mcp/Dockerfile:8 && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \Odoo Claude Mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/extract_settings_schema.py:15 r = subprocess.run(["git", "-C", str(src.parent), "rev-parse", "--short"Orcaslicer Mcp (MCP server)
Compatibility: Not stated.
Let Claude work alongside you in a real, running OrcaSlicer.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
AGENT_HIDDEN_STEP
skills/people-context-usage/SKILL.md:661 candidate through `stage_candidates`, which does carry `stated_by`. DPeople Context (MCP server)
Compatibility: Not stated.
Give Claude Code local, durable context about the people in your life through people-context-mcp.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT NETWORK_HOST_FROM_INPUT
.devcontainer/Dockerfile:15 RUN curl -LsSf https://astral.sh/uv/install.sh | shredmine_ai_helper (MCP server)
Compatibility: Not stated.
- [Redmine AI Helper Plugin](#redmine-ai-helper-plugin) - [✨ Features](#-features) - [Chat Interface](#chat-interface) - [Issue Summarization](#issue-summarization) - [Create a comment draft with AI Helper](#create-a-comment-draft-with-ai-helper) - [Generate subtasks from issues]
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
internal/cmd/update/update.go:407 " curl -fsSL https://raw.githubusercontent.com/%s/%s/main/install.sh | bash\Redmine Cli (MCP server)
Compatibility: Not stated.
Drive Redmine from Claude Code: bundled agent skill plus MCP server.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +2 more
src-tauri/resources/video_html_capture.mjs:233 try { fs.rmSync(profileDir, { recursive: true, force: true });RepoTunnel (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
src/lib/clipboard.ts:140 // We use the underlying child_process.spawn via execFile's sibling APIsipcode (MCP server)
Compatibility: Not stated.
Token-economy observatory for Claude Code: forensic per-session audit, A/B savings verifier, reproducible benchmark, and cost prediction , directly in Claude chat.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +2 more
internal/cli/init.go:62 cmd = exec.Command("open", url)stacklit (MCP server)
Compatibility: Not stated.
Use stacklit.json to navigate codebases without burning tokens on file exploration
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
packages/server/src/routes/install.ts:102 <h3>Linux / macOS</h3>${code(`curl -fsSL ${server}/install.sh | sh`)thelastsaas (MCP server)
Compatibility: Not stated.
The Last SaaS is a TypeScript backend for records, files, team permissions, notifications, and audit logs, accessed through an HTTP API, MCP, or CLI.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
src/usagetrim/core/json_slimmer.py:337 """Compact REST API and curl response payloads.usagetrim (MCP server)
Compatibility: Not stated.
<p align="center"> <picture> <source media="(prefers-reduced-motion: reduce)" srcset="https://raw.githubusercontent.com/00200200/usagetrim/main/assets/readme-hero.png"> <img src="https://raw.githubusercontent.com/00200200/usagetrim/main/assets/readme-hero.gif" width="100%" alt="U
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
AGENT_IGNORE_INSTRUCTIONS
docs/guide.md:352 - Direct instruction overrides (`ignore previous instructions`, `disregard the rules`, `forgWidemem Ai (MCP server)
Compatibility: Not stated.
> <img src="https://raw.githubusercontent.com/remete618/widemem-ai/main/docs/widemem-fish.png" width="48" align="middle" alt="widemem fish" /> *Goldfish memory?
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
src/wpguard_mcp/transports/ssh_wpcli.py:65 proc = subprocess.run(ssh_cmd, capture_output=True, text=True, timeWPGuard MCP (MCP server)
Compatibility: Not stated.
**Put your AI assistant to work on WordPress.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
package.json:51 preparezoteus (MCP server)
Compatibility: Not stated.
Zotero library for your agent: search, PDF passages with page locators, CSL citations, add by DOI, group libraries, and safe writes.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
projects/second-brain/config/scripts/setup-vault-mac.sh:100 curl -fsSL https://claude.ai/install.sh | bash2Nd Brain (Skill)
Compatibility: Not stated.
**한국어** · [English](README.en.md)
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
package.json:37 prepareadg (Skill)
Compatibility: Not stated.
`adg` is one umbrella CLI with **two domains**, each aligned to an existing ecosystem so there is little new to learn:
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
skills/record-walkthrough/scripts/record.mjs:346 user authorization to install via mise (curl https://mise.runAgent Skills (Skill)
Compatibility: Not stated.
Charley's Agent Skills for engineering, memory, and media.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
skills/android-e2e-verification/SKILL.md:37 curl -fsSL "https://get.maestro.mobile.dev" | bashAgent Skills Android (Skill)
Compatibility: Not stated.
Production-grade Android engineering skills for AI coding agents.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
update.sh:28 curl -fsSL "$INSTALL_URL" | sh -s -- $FLAGAgent Skills (Skill)
Compatibility: Not stated.
fortrabbit agent-skills extends your coding assistant with domain knowledge on fortrabbit.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
AGENT_HIDDEN_STEP
plugins/mindbox/skills/whypromo/SKILL.md:204 identifier: fix the request and retry, do not tell the user. **`TAgent Skills (Skill)
Compatibility: Not stated.
Documented Claude Code plugins by [mindbox.cloud](https://mindbox.cloud/?locale=en_US) , ready to install.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +2 more
plugins/agentchef/scripts/codex-process-hygiene.mjs:948 fs.unlinkSync(resolvedState);agentchef (Skill)
Compatibility: Not stated.
<p align="center"> <img src="assets/banner.svg" alt="AgentChef: a safer, clearer setup for terminal coding agents with agents, skills, MCPs, approvals, and verification" width="100%" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/local-github-checks.py:37 completed = subprocess.run(command, cwd=ROOT, env=env, check=False) # noqa:Ai Repo Safety Skill (Skill)
Compatibility: Not stated.
Git-hook-backed secret and supply-chain gates for AI-coded repos.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT NETWORK_HOST_FROM_INPUT
.beads/README.md:64 curl -sSL https://raw.githubusercontent.com/steveyegge/beads/main/scripts/install.sh | basAi Security Corpus (Skill)
Compatibility: Not stated.
<p align="center"><img alt="AI Security Corpus" src="assets/banner.svg" width="100%"></p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
content/skills/huggingface--hf-cli.md:1 Install: `curl -LsSf https://hf.co/cli/install.sh | bash -s`.AIskillsintro (Skill)
Compatibility: Not stated.
把 Anthropic、K-Dense、OpenAI、Vercel、Hugging Face 的 200 多個 Agent Skills 排成一張週期表，每個 skill 都有中文用途、限制和可直接貼給 agent 的起手提示，以及 Claude Code、Codex、Gemini CLI、Cursor、Grok Build 的安裝指令。
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST +3 more
desktop/repository-import.cjs:48 finally {await fs.unlink(pending).catch(()=>{});}Asl Harness (Skill)
Compatibility: Not stated.
<p align="right"> <strong>简体中文</strong> · <a href="README_EN.md">English</a> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
docs/installation.md:20 curl -LsSf https://astral.sh/uv/install.sh | shautoharness (Skill)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
skills/ai-courseware-maker/scripts/deck_build.py:480 def fetch(url: str, folder: Path, stem: str) -> Path:Beatra Skills (Skill)
Compatibility: Not stated.
Agent Skills for creative production.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
OBFUSCATION_ENCODED_BLOB OBFUSCATION_MINIFIED_PAYLOAD
preview/reference-content.js:1 import { exampleDialogAttribute } from "./interaction.js";carapace (Skill)
Compatibility: Not stated.
Carapace is the shared visual foundation for OpenClaw public sites and products.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skills/caveman-compress/scripts/compress.py:157 result = subprocess.run(Caveman Zh Cn (Skill)
Compatibility: Not stated.
Caveman 简体中文版：让 AI agent 用极简风格回话，输出 token 少 65%，技术内容零损失。
This grade is a hygiene screen, not proof of safety.
