Claude Plugins — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Claude Plugins (Plugin) and scored it 15/100 (red). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 3 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 6 flagged
A GitHub token ('ghp_0123456789abcdefghijklmnopqrstuvwxyz',) is committed directly into this plugin's source. Anyone who reads the repo — including everyone who installs the plugin — gets the token, so it must be treated as already compromised.
GITHUB_TOKEN = "ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"# never commit the token; read it at runtime from the environment
GITHUB_TOKEN = os.environ["GITHUB_TOKEN"]This plugin references an SSH private-key path or a private-key file header (assert.ok(!clean('key -----BEGIN RSA PRIVATE KEY…). An SSH private key authenticates you to servers and Git remotes, so code that reads it can impersonate you wherever that key is trusted.
key = open(os.path.expanduser("~/.ssh/id_rsa")).read()
requests.post(url, data={"key": key})# let the SSH agent / git handle auth; never read or send the key
subprocess.run(["git", "fetch", remote], check=True)The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Foundry is a plugin marketplace for Claude Code and Codex, and the home of two plugins that also run on Antigravity. It lists three plugins that help a coding session continue where the last one stopped, say less while it works, and add less code.
| Plugin | Use it when | Hosts |
|---|---|---|
| Foreman | The next session needs the plan, the next task and a checked handoff | Claude Code, Codex and Antigravity |
| Hush | Running commentary buries the result you asked for | Claude Code |
| Razor | A small change keeps growing into new packages and files | Claude Code, Codex and Antigravity |
Each plugin works on its own. Its page holds the commands, settings, limits and measurements. Flint is not a plugin. It is two text files with the same writing voice and coding rules, for a session where you do not want to install anything.
Inside Claude Code, add the marketplace once, then install the plugin you want:
/plugin marketplace add V-Songbird/foundry
/plugin install foreman@foundryStart a new session to load the plugin. Its skills then appear under the plugin's name, for example /foreman:foreman. /plugin uninstall foreman@foundry removes it again.
In Codex, Foreman and Razor install the same way:
codex plugin marketplace add V-Songbird/foundry
codex plugin add razor@foundryReview and trust the plugin's hooks with /hooks, then start a new Codex session. Hush has no Codex package.
Both hosts use the name foundry and read their own catalog. Each entry pins one commit of the plugin's repository, so an install stays the same until the catalog moves.
Antigravity has no marketplace for third-party plugins, so it installs Foreman or Razor from a clone of this repository. The clone checks each plugin out at the commit the catalogs pin, so Antigravity gets the same release as Claude Code and Codex. Clone with the submodules, then install a plugin directory:
git clone --recurse-submodules https://github.com/V-Songbird/foundry.git <path-to-clone>
agy plugin install <path-to-clone>/razor
agy plugin listThe list should name the plugin. Start a new conversation to load it. The install is a copy, so it stays at that commit. To take a new release, update the clone, install again and start a new conversation:
git -C <path-to-clone> pull
git -C <path-to-clone> submodule update --init
agy plugin install <path-to-clone>/razorFoundry has no configuration of its own. Each plugin's page lists its settings.
The plugins are Git submodules. Clone with them:
git clone --recurse-submodules https://github.com/V-Songbird/foundry.gitRun a plugin's tests from its own directory, with Node.js 22 or later and Git available:
cd foreman
node --test tests/*.test.jsThe command reports each test and exits non-zero on failure. From the root, claude plugin validate . checks the Claude Code catalog and prints Validation passed, and agy plugin validate foreman checks a plugin's Antigravity package.
A release moves the plugin's version in its own repository, then the commit pins in both catalogs. The cut-release skill under .claude/skills/ walks through it. Read AGENTS.md before changing a catalog.
The harness that measures each plugin lives in benchmarks/. The benchmarks README covers its free offline tests and its paid live runs.
The plugin pages share one layout, described in the README contract. Their banners, icons, mascot scenes and charts are built from brand/; the brand guide covers the colors, the generators and how an image reaches a plugin.
SECURITY.md gives a private address. Do not post details publicly. The catalogs have no separate policy.MIT. See LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.