From repo-forensics
Audits git repositories, AI skills, and MCP servers for security risks including dependencies, prompt injection, credential theft, runtime dynamism, manifest drift, CVEs, and exploited vulns.
npx claudepluginhub alexgreensh/repo-forensics --plugin repo-forensicsThis skill is limited to using the following tools:
<!-- repo-forensics v2 | built by Alex Greenshpun | https://linkedin.com/in/alexgreensh -->
checksums.jsondata/README.mddata/compromised_versions.jsonreferences/mcp-attack-patterns.mdreferences/research_sources.mdreferences/threat_patterns.mdscripts/aggregate_json.pyscripts/auto_scan.pyscripts/dast_sandbox.sbscripts/forensics_core.pyscripts/ioc_manager.pyscripts/parse_pnpm_lock.pyscripts/pre_scan.pyscripts/run_forensics.shscripts/scan_agent_skills.pyscripts/scan_ast.pyscripts/scan_binary.pyscripts/scan_dast.pyscripts/scan_dataflow.pyscripts/scan_dependencies.pyOrchestrates repo security scans (SAST, SCA, secrets, config) with adaptive agent swarms: subagents for small repos, teams for large. Verifies findings, compiles reports.
Scans local projects for dependency vulnerabilities (SCA), code security patterns (SAST), leaked secrets, auth/crypto flaws, misconfigs, supply chain risks, CI/CD issues. Generates prioritized report with remediation guidance.
Detects execution risks, supply chain vulnerabilities, data exfiltration, and prompt injections in Claude Code plugins. Use for auditing plugins, MCP configs, hooks, and scripts.
Share bugs, ideas, or general feedback.
Deep security auditing for repositories, AI agent skills, and MCP servers.
git clone, git pull, pip install, npm install/update, gem install/update, brew install/upgrade, etc. Zero-overhead for non-matching commands.package-lock.json, yarn.lock, poetry.lock, Pipfile.lock for supply chain IOCsscan_dast.py): Dynamic analysis of Claude Code hooks with 8 malicious payload types, sandboxed executionscan_integrity.py): SHA256 baselines for critical config files, drift detection with --watch--update-iocs): Pull latest indicators of compromise from remote feed--verify-install): Verify repo-forensics itself hasn't been tampered withaction.yml): CI/CD integration for automated security gatingscan_runtime_dynamism.py): Detects code that changes behavior after install: dynamic imports, fetch-then-execute, self-modification, time bombs, dynamic tool descriptionsscan_manifest_drift.py): Compares declared vs actual dependencies, catches phantom deps, runtime installs, conditional import+install fallbacksFull audit (all 19 scanners):
./scripts/run_forensics.sh /path/to/repo
Focused AI skill scan (10 scanners, faster):
./scripts/run_forensics.sh /path/to/repo --skill-scan
With IOC update and integrity monitoring:
./scripts/run_forensics.sh /path/to/repo --update-iocs --watch
Verify your installation:
./scripts/run_forensics.sh /path/to/repo --verify-install
JSON output for automation:
./scripts/run_forensics.sh /path/to/repo --format json
| Level | Score | Meaning | Exit Code |
|---|---|---|---|
| CRITICAL | 4 | Active threat, immediate action required | 2 |
| HIGH | 3 | Significant risk, investigate promptly | 1 |
| MEDIUM | 2 | Potential issue, review recommended | 1 |
| LOW | 1 | Informational, may be false positive | 0 |
| Scanner | What It Detects | Mode |
|---|---|---|
| runtime_dynamism | Dynamic imports, fetch-then-execute, self-modification, time bombs, dynamic tool descriptions | skill + full |
| manifest_drift | Phantom dependencies, runtime package installs, conditional import+install, declared-but-unused deps | skill + full |
| skill_threats | Prompt injection, unicode smuggling, prerequisite attacks, ClickFix, MCP tool injection | skill + full |
| agent_skills | SKILL.md frontmatter abuse, tools.json FSP, agent config injection (SOUL.md/AGENTS.md/CLAUDE.md), .clawhubignore bypass, ClawHavoc IOCs. Covers Claude Code, OpenClaw, Codex, Cursor, MCP. | skill + full |
| mcp_security | SQL injection to prompt escalation, tool poisoning, rug pull enablers, config CVEs | skill + full |
| dataflow | Source-to-sink taint tracking (env vars to network calls), cross-file import taint | skill + full |
| secrets | 50+ patterns: API keys, tokens, private keys, database URIs, JWTs, framework env prefix leaks, 1Password/Vault tokens, .env variant files | skill + full |
| sast | Dangerous functions, injection, shell execution across 8 languages, process.env exposure, path traversal | skill + full |
| lifecycle | NPM hooks + Python setup.py/pyproject.toml cmdclass overrides + anti-forensics (self-deleting installers, package.json overwrite) | skill + full |
| integrity | SHA256 baselines for .claude/settings.json, CLAUDE.md, hook scripts. Drift detection with --watch | full |
| dast | Dynamic hook testing: 8 payload types (injection, traversal, amplification, env leak) in sandbox | full |
| entropy | Per-string Shannon entropy, base64 blocks, hex strings (combo detection) | full |
| infra | Docker (ENV/ARG secrets, .env COPY), K8s, GitHub Actions, Claude Code config (CVE-2025-59536, CVE-2026-21852, CVE-2026-33068) | full |
| devcontainer | JSON-based devcontainer.json analysis: host mounts, privileged mode, docker.sock, remoteEnv localEnv interpolation, lifecycle commands, untrusted features | skill + full |
| dependencies | NPM + Python typosquatting, l33t normalization, IOC packages (SANDWORM_MODE 2026), compromised version detection (Axios, liteLLM), suspicious scope detection (iflow-mcp) | full |
| ast_analysis | Python AST: obfuscated exec chains, __reduce__ backdoors, marshal/types bytecode, audit hook abuse, self-modification | full |
| binary | Executables hidden as images/text files | full |
| git_forensics | Time anomalies, GPG signature issues, identity inconsistencies | full |
The scan_dast.py scanner executes hook scripts with malicious payloads in a sandboxed subprocess:
8 payload types:
Safety: All execution uses subprocess with 5s timeout, stdout/stderr capture, scrubbed environment, temp directory isolation, no shell=True.
The scan_integrity.py scanner protects critical configuration files:
.claude/settings.json, CLAUDE.md, .mcp.json, hook scripts--watch mode: Creates baseline on first run, alerts on drift on subsequent runsThe dependency scanner automatically enriches findings with live vulnerability data:
(ecosystem, package, version) found in a manifest or lockfile is queried against api.osv.dev. Matches emit a cve finding with CVSS-mapped severity and suggested fix versions.cve-kev) regardless of CVSS, because exploitation in the wild is the strongest prioritization signal.~/.cache/repo-forensics/kev.json). OSV per-package queries cache 24h (~/.cache/repo-forensics/osv-queries.json, LRU-capped at 4000 entries). Both files are written atomically with mode 0o600.--offline uses cached data only; --no-vulns disables the feature entirely.--update-vulns refreshes the KEV catalog before scanning. Standalone tool: python3 scripts/vuln_feed.py --query npm lodash 4.17.20.The --update-iocs flag pulls latest indicators of compromise from a hosted JSON feed:
.forensics-iocs.json (24h TTL)ioc_manager.py (--show to inspect, --update to pull)The --verify-install flag checks that repo-forensics itself hasn't been tampered with:
checksums.json (SHA256)verify_install.py --generate at release time to create checksumsThe scan_skill_threats.py scanner detects 10 categories of AI agent skill attacks:
<IMPORTANT> tag, "note to the AI", hidden instructions in JSON description fields)The scan_mcp_security.py scanner covers MCP-specific attack vectors discovered in 2025-2026:
Hidden instructions injected into tool description fields load into LLM context without user visibility. Canonical pattern: <IMPORTANT> tag (Invariant Labs, 2025).
SQL injection in MCP server code can write malicious prompts into databases that are later retrieved and executed by agents (Trend Micro TrendAI, May 2025).
.claude/settings.jsonANTHROPIC_BASE_URL override exfiltrates API keys0.0.0.0 bindingbypassPermissions in .claude/settings.jsonenableAllProjectMcpServers: true: Bypasses per-server consent dialogsCross-tool contamination where one tool's description instructs the LLM to modify behavior of other tools (Invariant Labs 2025).
Tool descriptions sourced from mutable data (database queries, network requests, environment variables, runtime file loads). These don't prove malicious intent but flag that tool behavior can change without code changes (Lukas Kania, March 2026; OWASP MCP07).
The scan_runtime_dynamism.py scanner detects static indicators that code will change behavior after install:
importlib.import_module(variable), __import__(env_var), require(variable), ES import(variable)requests.get(url).text piped to eval(), runtime pip install/npm install, download-and-run scriptstypes.FunctionType(), types.CodeType(), marshal.loads(), open(__file__, 'w'), SourcelessFileLoader (CVE-2026-2297)datetime.now() > datetime(2026,6,1), unix timestamp comparisons, counter-based activation, probabilistic triggersdb.query(), requests.get(), os.environ, conditional descriptionsUses both regex patterns and Python AST analysis for reliable detection.
The scan_manifest_drift.py scanner compares what a package DECLARES vs what it actually USES:
requirements.txt/package.jsonsubprocess.run(["pip", "install", pkg]) in codetry: import X except: os.system("pip install X")Supports Python (requirements.txt, pyproject.toml, setup.py) and Node.js (package.json).
The correlation engine (forensics_core.py) identifies compound threats across 14 rules:
Create .forensicsignore in the repo root to suppress false positives:
tests/fixtures/secrets.json
legacy/unsafe_code/*
src/config/dev_keys.py
Note: .forensicsignore itself is scanned for attacker-planted wildcard suppression patterns.
--format text (default): Colored human-readable output with severity tags--format json: Machine-readable JSON array of Finding objects--format summary: Counts only (for CI/CD scripting)Add to your workflow:
- uses: alexgreensh/repo-forensics@v1
with:
mode: full
format: text
update-iocs: true
See references/research_sources.md for full credits and links to the published research that informed this skill's threat detection capabilities.