harness-ops

    Claude Code operations: audit-skill-visibility (skills the listing budget hides), inventory (every invocable surface), audit-install-state, audit-performance (slowness), audit-mod-posture (mods and the guard), audit-native-overlap (skills duplicating built-ins), observability (telemetry), known-issues, changelog, behavior-probes, prerequisites, check, machine-profile, plugins (update the fleet), lanes (background loop sessions), setup. Plus opt-in hook event logs.

    Rank#1000
    melodic-softwareclaudemodsLast scanned Nov 15, 2026, 08:01 PMhttps://github.com/melodic-software/claude-code-plugins
    Created
    5 months ago
    Last commit
    2 hours ago

    Ecosystem

    1 related extension

    Security Findings

    5

    Unicode smuggling

    MaliciousBundled

    Source code contains 4 suspicious invisible unicode chars

    skills/audit-native-overlap

    No tagged releases

    SuspiciousLineage

    Repo ships no git tags and no GitHub releases — consumers cannot pin to stable, reviewable versions

    In-process hooks module

    SuspiciousScanner

    Runs in the Claude Code process. Hooks: classic.ConfigChange, classic.CwdChanged, classic.DirectoryAdded, classic.Elicitation, classic.ElicitationResult, classi.... Calls: $.env.get, $.process.run. Informational, does not affect the trust score

    hooks/register.ts

    Hooks module intercepts agent events2×

    SuspiciousScanner

    Hooks classic.ConfigChange, classic.CwdChanged, classic.DirectoryAdded, classic.Elicitation, classic.ElicitationResult, classi...: can answer or skip settings hooks for these events

    Hooks classic.Notification, classic.PreCompact, classic.SessionEnd, classic.SessionStart, classic.Stop, classic.SubagentStart,...: lifecycle settings hooks. Informational, does not affect the trust score

    hooks/register.ts

    Contents

    19 skills bundled by this extension

    1 elevated risk7 lower risk11 no risk known

    audit-native-overlap

    skill

    High
    skills/audit-native-overlapfcd129619357…

    Why it’s flagged

    Unicode smuggling

    Source code contains 4 suspicious invisible unicode chars

    audit-mod-posture

    skill

    Low
    skills/audit-mod-posture68a61cd268fb…

    behavior-probes

    skill

    Low
    skills/behavior-probesa7d4b76d130e…

    control-claude-code

    skill

    Low
    skills/control-claude-code022ae98ec3fd…

    inventory

    skill

    Low
    skills/inventoryb23d946abdf3…

    lanes

    skill

    Low
    skills/lanescdc50bf40b92…

    observability

    skill

    Low
    skills/observability0ef6147f5a8f…

    plugins

    skill

    Low
    skills/pluginsf7b4182ebb69…

    audit-install-state

    skill

    None known
    skills/audit-install-statede652039220f…

    audit-performance

    skill

    None known
    skills/audit-performancef0a058d770d1…

    audit-plugin-landscape

    skill

    None known
    skills/audit-plugin-landscaped512dd5d783f…

    audit-skill-visibility

    skill

    None known
    skills/audit-skill-visibilitye974b374570a…

    changelog

    skill

    None known
    skills/changeloge4180f472eb9…

    demo

    skill

    None known
    skills/changelog/evals/fixtures/consumer-repo/.claude/skills/demo60efed99ed75…

    known-issues

    skill

    None known
    skills/known-issuesd68caac14f58…

    machine-profile

    skill

    None known
    skills/machine-profile2532e936cce6…

    plugins-audit

    skill

    None known
    skills/plugins-audit734479fb3b52…

    prerequisites

    skill

    None known
    skills/prerequisites50a1f5bb120b…

    setup

    skill

    None known
    skills/setup3b86a1c3fb2b…

    Editions

    5
    • Scanned Nov 15, 2026, 08:01 PMHigh
    • Scanned Nov 14, 2026, 08:01 PMHigh
    • Scanned Nov 13, 2026, 08:32 PMHigh
    • Scanned Nov 11, 2026, 08:20 PMHigh
    • Scanned Nov 10, 2026, 08:19 PMHigh