Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 51 to 58 of 58 Codex, Grade D entries. Page 2 of 2.
Listed A to Z by name.
No entries match that filter.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +3 more
run_tests.py:32 completed = subprocess.run(Web Ui Quality Open Source (Plugin)
Compatibility: Not stated.
Visual finish and usable interactions for AI-assisted Web projects.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
codex/block-curl-pipe-sh/scripts/block-curl-pipe-sh.sh:6 # The threat: `curl https://x | sh` (and its kin) runChock Codex Plugins (Plugin)
Compatibility: Not stated.
<p align="center"> <img src="https://raw.githubusercontent.com/open-coder-ai/chock/main/docs/assets/logo.svg" alt="chock logo" width="110"> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
plugins/expectation-bridge/web/app.js:318 const response = await fetch("/api/state", { headers: { AuthorizatioExpectation Bridge (Plugin)
Compatibility: Not stated.
**Align on what “done” means before an agent starts , and keep that agreement visible while the work changes.**
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
plugins/llmwiki-lite/scripts/git_web.py:814 def fetch(repo, payload):Llmwiki Lite Codex Plugin (Plugin)
Compatibility: Not stated.
这是与旧 `llmwiki-research` 架构完全分离的轻量版科研与项目知识助手，同一份源码同时支持 **Codex**、**Claude Code** 和 **opencode**。
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
docs/assets/site.1a6b8ae8e53f.js:133 pending = fetch(data.index, {signal:controller.signal}).then(response =>Vibe Coding (Plugin)
Compatibility: Not stated.
Evidence-based coding workflows: 46 skills, 241 domain recipes, scoped implementation and verification.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB OBFUSCATION_MINIFIED_PAYLOAD
scripts/stickers.mjs:283 OPENAI_API_KEY in your environment or a .env file. Without a key, run --provider nonVocabloot Deck Kit (Plugin)
Compatibility: Not stated.
Make a Vocabloot deck from a conversation: app-ready cards, stickers and a .vlbackup that imports as is.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV +1 more
scripts/audit_freshness.py:674 result = subprocess.run(Repo Scaffold Plugin (Plugin)
Compatibility: Not stated.
Agent Skills plugin for Codex and Claude Code that scaffolds repositories to production GitHub.com standards.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
cc-plugin/skills/triggers/SKILL.md:111 const res = await fetch(url, { signal: AbortSignal.timeout(10_000) });Self Starter (Plugin)
Compatibility: Not stated.
<h1 align="center">Self-Starter</h1>
This grade is a hygiene screen, not proof of safety.
