repo-audit.
A Claude Code / agent skill that reads third-party code for red flags before you install it.
#What it is
A read-only audit procedure packaged as a skill. Pointed at a repo, package, skill, plugin, or MCP server, it runs a six-phase pass that ends in a SAFE, SAFE-WITH-CONDITIONS, or UNSAFE verdict with evidence, every red flag quoted verbatim, and concrete conditions such as pinning to a commit SHA. It fetches, clones, and reads. It never installs, builds, or runs the target, because running the target would be the attack succeeding early.
#The itch
Agents install third-party skills the way people run curl | bash. Installation is the moment of maximum exposure: install hooks run arbitrary code with your user's rights, and agent-facing files like skills and MCP tool descriptions get to whisper instructions to a model that holds your tools and credentials. In registry and repo-level supply-chain compromises the malicious code is usually findable in advance. It ships because nobody looked before running. This skill is the look before running.
#How it works
Six phases, each with the class of attack it catches:
| Phase | Looks at | Catches |
|---|---|---|
| 1 | Identity and reputation | repackaged clones, typosquats, empty-shell accounts |
| 2 | What runs at install time | postinstall hooks, setup.py, curl | bash installers |
| 3 | Code, hotspots first | obfuscated blobs, credential theft, conditional payloads |
| 4 | Dependencies and CI | install scripts across the tree, known-malicious packages (OSV) |
| 5 | Agent-facing files | prompt injection, instructions serving the vendor over you |
| 6 | License | missing or mismatched license, uncredited copied code |
Depth scales to blast radius: an agent skill is small text with catastrophic reach, so every file gets read; a large library gets a full phase 1 and 2 pass plus a hotspot pass, with what was skipped declared in the verdict. Every audit ends in the same fixed shape, so verdicts stay comparable, and each one closes with two to four spot-checks you can reproduce yourself in minutes.
#In real use
Two real audits are written up in full in the repo. One ended UNSAFE: a young repo advertising an installable CLI turned out to be a legitimate project cloned, its README rewritten into a "download and double-click the installer" funnel, with a Windows malware dropper checked in. Caught read-only, without ever running the payload. The other ended SAFE-WITH-CONDITIONS: a mid-size community Claude skill, security-clean under a full phase 5 read, but shipped without a license and with broad tool grants on its sub-agents. Conditions, not a clean bill.
The limits the README states: an audit reduces risk and cannot prove absence of malice. A verdict binds to one commit or version, so pin by SHA and treat any later update as unaudited. And popularity is not an audit: stars can be bought, and typosquats live off famous names.
#Install
$ git clone --depth=1 https://github.com/belschak/repo-audit.git ~/.claude/skills/repo-auditNo build, no dependencies. The skill triggers on "is this safe?", "audit this repo", "should I install X", or a pasted GitHub/npm/PyPI link with intent to install. It also triggers when the agent itself is about to recommend third-party code.