Check a GitHub repo before you download it.
Paste a link. In a few seconds you get a grade from A to F and a plain-English list of warning signs, including tricks that target your AI assistant.
Try:
Directory
AI tools people keep telling you to install
Re-checked every night.
How we score
100 points, four questions
We only read public information from GitHub. We never run the code. Some warning signs are so serious they cap the score no matter how popular the repo is.
30
Do people trust it?
- How many people starred and copied it
- How long the owner has been on GitHub
25
Is anyone looking after it?
- When it was last updated
- How old it is
- Whether it ships proper releases
15
Is it open about itself?
- A license
- Real instructions
- A way to report security problems
30
Any malware tricks?
- "Turn off your antivirus"
- Password-protected zips, cracks, free premium
- Fake stars, brand-new accounts
- AI instruction files that try to hijack your assistant
A low grade comes with one of two labels. Dangerous means we found malware tricks. Unproven means nothing looks wrong, but the project is too new or little-known to trust yet.
A score is a set of warning signs, not a guarantee. A clever attacker can pass every check. When in doubt, don't install it on a work computer, and ask your IT team.
Pricing
Free for one-off checks
Free
$0
- Unlimited checks in your browser
- The full directory
- Weekly newsletter
Pro
$7 / month
- Watchlist: email me if a repo I use turns risky
- Deep check of every file, not just the front page
- Shareable PDF report for your IT team
Team
$49 / month
- Approved-tools list for your whole office
- Slack or Teams alerts
- Up to 25 people