repo-security-audit

To scan a GitHub repository for malware before running the code, this Skill clones the URL into a sandboxed environment and uses static analysis to detect malicious patterns, obfuscation, and credential exfiltration.

Static analysis for supply chain risks involves scanning dependency manifests and install hooks within a sandbox to detect suspicious scripts, obfuscated code, and credential exfiltration without executing the repository code.

You can detect obfuscated code and credential exfiltration in remote scripts by running an automated security audit that uses grep and read tools to analyze install hooks and network patterns in a sandbox.

No, the security audit does not execute the repository code during scanning. It conducts static analysis in a sandboxed environment using tools like grep and read to identify malicious patterns safely.

Yes, a security audit can be triggered automatically when GitHub URLs or requests to install and run remote code are detected, ensuring the repository is scanned for malware before execution.