repo-security-review

Audit GitHub repositories for malicious code and suspicious dependencies.

29|2|Updated Jan 11, 2026

Search Tags:#code review #security #github #dependencies #audit #malware

Ready to run

npx skills add https://github.com/jbdamask/john-claude-skills --skill repo-security-review

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: repo-security-review
Source: https://github.com/jbdamask/john-claude-skills/tree/main/skills/repo-security-review
Command: npx skills add https://github.com/jbdamask/john-claude-skills --skill repo-security-review

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you identify potential security risks in GitHub repositories before installing or using their code, protecting you from malicious software, data exfiltration, and suspicious dependencies.

Core Features & Use Cases

Install Script Analysis: Scans installation scripts for dangerous commands, unexpected network calls, and unauthorized file modifications.
Source Code Review: Examines application code for data collection, hardcoded secrets, and obfuscated logic.
Dependency Auditing: Checks package manifests for suspicious or malicious packages.
Use Case: Before installing a new command-line tool from GitHub, use this Skill to perform a thorough security audit to ensure it's safe to run on your system.

Quick Start

Use the repo-security-review skill to audit the GitHub repository at https://github.com/example/repo.

Frequently Asked Questions about repo-security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I check a GitHub repository for malicious code before installing it?▼

To check a GitHub repository for malicious code, you can run a security audit that analyzes install scripts, source code, and package manifests to detect data exfiltration and suspicious dependencies. This process provides a risk assessment before you run any software.

What does an install script security audit look for in a GitHub repo?▼

An install script security audit scans for dangerous commands, unexpected network calls, and unauthorized file modifications within the repository. This helps identify potential malware and prevents unauthorized access to your system during installation.

How do I review package dependencies for vulnerabilities and suspicious packages?▼

To review package dependencies for vulnerabilities, you can audit the package manifests within a repository to identify suspicious or malicious packages. This checks your project's dependency tree for known security risks and data exfiltration attempts.

Does a GitHub source code review detect hardcoded secrets and obfuscated logic?▼

Yes, a GitHub source code review examines application code to detect hardcoded secrets, obfuscated logic, and unauthorized data collection. This ensures the repository files are analyzed thoroughly for known security red flags and vulnerabilities.

Can I use a code review audit for any public GitHub repository?▼

You can use a code review audit for any public GitHub repository by fetching the repository files and analyzing the script content. This allows you to perform a thorough security audit on any open-source tool before integrating it.

When should I perform a dependency audit on a GitHub repository?▼

You should perform a dependency audit before installing a new command-line tool or integrating a package from GitHub. This proactive security audit identifies malicious packages and data exfiltration risks before they can affect your system.