vet-repo

What it does

Scans a repository's agent configuration files for known malicious patterns before you trust or run its configurations. Checks Claude settings, skill files, MCP configs, and project instruction files. Outputs a severity-grouped report with recommendations.

Why it's useful

Catches agent-level attack vectors like hook auto-approval, hidden curl|bash chains, and instruction injection that standard code review tools don't check for.