audit-third-party-software

To audit third-party software for security risks, perform isolated static analysis on repos, tarballs, binaries, or plugins to detect telemetry, prompt injection, and credential leakage, producing a SAFE, CAUTION, or UNSAFE verdict with file-level citations.

Static analysis for supply chain safety involves reviewing unfamiliar GitHub repositories before execution to identify telemetry, data exfiltration, and unsafe local services, yielding an evidence-backed triage with domain classification and a structured safety report.

To check a binary for telemetry and phone-home behavior, extract URLs and domains from a strings dump, then triage them into benign, unknown, or cloud-SDK categories to identify potential closed-source data exfiltration risks.

Yes, you can audit Claude Code plugins for prompt injection risks by applying threat-focused static checks to the plugin code, generating a structured safety verdict with actionable install recommendations and line-level citations.

The best way to triage third-party risk for a safe install is to execute isolated static analysis focusing on supply-chain behavior, secrets handling, and unsafe local services, resulting in an evidence-backed SAFE, CAUTION, or UNSAFE report.

Static analysis may be insufficient when binaries contain obfuscated telemetry or dynamic payload fetching that masks phone-home behavior, requiring additional runtime monitoring to fully validate safe installation criteria.