cls-certify
Security & Sandbox
B rating
License: MIT declared in README.md; full license not bundled
A review-assistance package with pattern scanning, dependency and URL checks, and report templates. Findings identify items for human review: a match is not proof of malice, and no match is not proof of safety. Certification terminology and grades such as S+ are the project’s output scheme, not evidence of independent certification or dynamic tests by this site.
Claude Code
Usage instructions
Reviewed: 2026-10-18. Method: static inspection of documentation, inventory and key code, without installation, network-function execution, authorization or sandbox tests. Package SHA-256: a81c676006cd43e4cde8b2f8707a178f4bd2037c6c1106d7490b203029ada19c. It matches the previously served local package; a different future download needs a new review.
- Read SKILL.md, README.md and tools before use. The documentation supplies a Claude Code installation path. Bash and script-specific dependencies are required; verify WSL or another suitable environment before copying Unix commands on Windows.
- Inspect an isolated source copy without running the target skill’s installer. Use a dedicated report directory rather than scanning the entire home folder.
- Review static findings in context. For online repository, vulnerability or URL checks, identify destination domains first. We did not execute these scripts.
Safety review
Reference rating B is this site's editorial assessment of this package's permission risk, not a certification score: A indicates relatively low privilege, B requires review of networking or local writes, and C involves credentials, real business writes or elevated capabilities and should be evaluated in isolation. No grade guarantees freedom from vulnerabilities. Platforms identify documented targets, not completed host-by-host execution tests.
- Secret-scan reports can include sensitive excerpts. Redact and restrict reports rather than uploading complete results containing credentials.
- check-update.sh contacts GitHub Raw. Online checks can reveal project or dependency information. HTML/PDF rendering also invokes local tools and writes outputs.
- A prompt-generated grade is not evidence of sandbox execution. False positives, missed issues and stale intelligence require human review.
Copyright and takedown notice: AI Islands curates this page from public information. Skills, code, documents and packages remain the property of their original authors or rights holders. This listing is provided for indexing, research and installation convenience. If you believe any listing or download link infringes your rights, contact ai-islands@streamflowintel.com with proof of ownership, relevant URLs and your request. We will review and remove or adjust the content promptly. Review package permissions, dependencies and safety risks before installing.