Free tool · Security · No sign-up
Is this GitHub project
safe to install?
Paste the link and we scan the code for malware, data theft and hidden tricks before you install it.
- per scan
- ~10 s
- sign-ups required
- 0
What others just checked
No scans yet. Be the first.
How it works
Three steps, nothing to install
- 1You paste the linkAny public GitHub repository: project, library, skill or plugin.
- 2We read the codeFiles are read straight from GitHub, in memory. Nothing runs on our server or your computer.
- 3You get the verdictGreen if it is clean. Red with every reason, the code snippet and the exact line.
The most common tricks in GitHub projects
- Hidden programs and malwareExecutables and archives in the repository, crypto miners and remote access to your computer.
.exe · xmrig · /dev/tcp - Password and key theftCode that reads .ssh, browser saved passwords and crypto wallets.
~/.ssh/id_rsa · Login Data - Hidden data uploadDiscord and Telegram webhooks, hard-coded IPs and services that receive your data.
discord.com/api/webhooks/… - Dangerous installScripts that silently download and run programs or install themselves to run on their own.
curl … | sh - Disguised codeExecuted base64, heavy obfuscation and binary files pretending to be text.
exec(base64.b64decode(…)) - Hidden AI instructionsPrompt injection in READMEs, skills and .md files telling your AI to do things you never asked.
ignore previous instructions
The verdict
A clear answer, no jargon
Nothing suspicious in the code. We show what was checked and how many files were read.
6 of 6 checks passedScanned commit and dateEvery reason in plain words, with severity, the code snippet, file and line.
Steals browser saved passwordsSends data to a Discord webhookFAQ
About the scan
How do I know if a GitHub project has malware?
Paste the link here. The tool reads the repository files and looks for hidden programs, password and key theft, hidden data uploads, dangerous installs, disguised code and hidden AI instructions. In a few seconds you get the verdict, with every reason explained.
Does the scan download or run the project?
No. Files are read as text straight from GitHub, in server memory, and discarded at the end. Nothing is installed, run or written to disk, here or on your computer. We only keep the result: which rules fired, the file and the line.
Is it free? Do I need an account?
It is free and needs no sign-up. To prevent abuse, each person can run a few scans every ten minutes, and a repository scanned recently returns the saved result instantly.
Does it work with Claude Code and Codex skills and plugins?
Yes, it was built for that. Besides the code, the scan looks for hidden AI instructions in .md files, hooks that run on their own and commands that skip the agent's permissions. You can paste the link to a specific folder of the repository.
Does a green result guarantee 100% safety?
No. The scan is automatic and looks for the most common tricks; a new or very well disguised attack can slip through. In large repositories we read the riskiest files first (install files, scripts, hooks) up to 400 files. Always check who published the project.
Read next
More on the blog
AI bubble: will it burst? What it means for you
Panthalassa: the wave power plant running AI in the open ocean
How Much Water Does AI Use? The Real Cost of Each QueryThe scan is automatic and checks the latest commit. No tool guarantees 100% safety: always check where a project comes from. We do not store the code of scanned repositories.