Security audit
Najpopularniejsze kody CPV
Security checks for vulnerabilities and agentic risk
Overview
The plugin is coherent with its description: it bundles a local CPV dataset and exposes read-only query tools/commands, requests no credentials or installs, and contains no unexpected network or filesystem access.
This skill appears to do exactly what it claims: serve a local dataset of popular CPV codes and expose read-only query tools. It does not request secrets or perform network/file exfiltration in the provided code. Before installing: (1) confirm you trust the author/source (installing a plugin runs its code in your gateway), (2) skim src/dataset.ts to ensure no sensitive data is included, and (3) if your environment enforces tool policies, allow the plugin id or the tool names listed in SKILL.md. If you need extra assurance, run the plugin in an isolated/dev instance first.
Static analysis
No suspicious patterns detected.
