Audit third-party GitHub repositories for supply-chain risks via static analysis.
npx skills add https://github.com/zcaceres/skills --skill investigate-repo
Please help me install this Agent Skill. Skill: investigate-repo Source: https://github.com/zcaceres/skills/tree/main/skills/investigate-repo Command: npx skills add https://github.com/zcaceres/skills --skill investigate-repo
This skill eliminates the uncertainty of using unfamiliar third-party code by performing a deep, automated security audit to identify malicious patterns before you ever run the software.
Invoke the investigate-repo skill by providing the GitHub URL of the repository you wish to audit.
High-intent search queries and answers about installing and using this skill.
Static analysis detects supply-chain risks like malicious install scripts and obfuscated code in third-party repositories. It targets unauthorized network exfiltration patterns through deep tree traversal and pattern matching, ensuring safety before you run the software.
Yes, you can detect npm package supply-chain risks using static analysis to scan for eval statements, unauthorized network beacons, and hidden credential harvesters. This provides an evidence-based verdict with specific file and line citations before installation.
Yes, ripgrep and GitHub CLI are required to execute deep tree traversal and pattern matching during the security audit. Git is also necessary to perform the comprehensive static analysis without executing the target code.
The best way to check for unauthorized network exfiltration is automated static analysis that identifies hardcoded URLs and dangerous install-time hooks. This yields a defensible verdict with specific file and line number citations.
You perform a security audit without executing code by running static analysis and pattern matching across the repository's file tree. This safely identifies malicious patterns like obfuscated payloads and credential harvesters.
Automated static analysis is ideal when you need to quickly evaluate unfamiliar third-party code for supply-chain risks. It instantly provides evidence-based verdicts with specific file citations, eliminating the uncertainty of manual review before installation.
skkeoriwClone, create, fork, and configure GitHub repositories via Git operations.
mkrlabsGenerate structured QA verdicts and metrics for validation workflows.
UseAI-proAudit OpenClaw skill network requests for exfiltration and unauthorized API calls.
gl0bal01Execute malware samples in sandboxes and capture runtime behavior with monitoring tools.
