Check a GitHub repo before you download it.
Paste a link. In a few seconds you get a grade from A to F and a plain-English list of warning signs, including tricks that target your AI assistant.
AI tools people keep telling you to install
Re-checked every night.
100 points, four questions
We only read public information from GitHub. We never run the code. Some warning signs are so serious they cap the score no matter how popular the repo is.
Do people trust it?
- How many people starred and copied it
- How long the owner has been on GitHub
Is anyone looking after it?
- When it was last updated
- How old it is
- Whether it ships proper releases
Is it open about itself?
- A license
- Real instructions
- A way to report security problems
Any malware tricks?
- "Turn off your antivirus"
- Password-protected zips, cracks, free premium
- Fake stars, brand-new accounts
- We read the name, topics, README and release notes
- AI instruction files that try to hijack your assistant
A repo needs at least 50 stars to get an A or B. A license and a README take minutes to add, so they can't make an unknown repo look safe on their own.
A low grade comes with one of two labels. Dangerous means we found malware tricks. Unproven means nothing looks wrong, but the project is too new or little-known to trust yet.
A score is a set of warning signs, not a guarantee. A clever attacker can pass every check. When in doubt, don't install it on a work computer, and ask your IT team.
Free for one-off checks
Free
$0
- Unlimited checks in your browser
- The full directory
- Weekly newsletter
Pro
$7 / month
- Watchlist: email me if a repo I use turns risky
- Deep check of every file, not just the front page
- Shareable PDF report for your IT team
Team
$49 / month
- Approved-tools list for your whole office
- Slack or Teams alerts
- Up to 25 people