Is that GitHub repo safe to download?

No. A grade is a set of warning signs, not a guarantee. An A means the project is well known, looked after, and shows none of the malware tricks we check for. A clever attacker can still pass every check, so only install what you need, and only from the official GitHub page.

Both can come with a low grade. Dangerous means we found tricks that malware uses, like asking you to turn off your antivirus. Unproven means nothing looks wrong, but the project is too new or too little-known to trust yet.

Stars are only part of the score, and they can be bought. A repo that got thousands of stars in a few days from a young account, or that asks you to turn off your antivirus, gets capped at a low grade however popular it looks.

Yes. Files like CLAUDE.md, AGENTS.md, SKILL.md or .cursorrules give instructions to AI coding tools. A malicious one can tell your AI to leak API keys or run commands without asking you. We read these files and flag the ones that try.

Most GitHub repos are safe, but some are malware dressed up as free tools. Warning signs include requests to turn off antivirus, password-protected zip files, brand-new accounts and repos that got thousands of stars in days.

No. We only read public information from GitHub: the project page, the owner's profile, the main folder, the release notes and any AI instruction files. Your browser asks GitHub directly.

Uninstall it, run a full scan with your antivirus, and change the passwords you use on that computer, starting with email and banking. If it's a work computer, tell your IT team right away.

GitHub lets each visitor do about 12 checks an hour for free. If you hit the limit, wait a few minutes and try again. Some work networks also block GitHub, so try another connection.