Is that GitHub repo safe to download?

No. A grade is a set of warning signs, not a guarantee. An A means the project is strong in every area we check and shows none of the malware tricks we look for. A clever attacker can still pass every check, so only install what you need, and only from the official GitHub page.

Both can come with a low grade. Dangerous means we found tricks that malware uses, like asking you to turn off your antivirus. Unproven means nothing looks wrong, but the project is too new or too little-known to trust yet.

Stars are only one of five areas, and they can be bought. The overall grade can be at most one letter better than the weakest area, so a popular repo that nobody updates, or with poor security habits, gets a lower grade. A repo that got thousands of stars in a few days from a young account, or that asks you to turn off your antivirus, is capped at a low grade however popular it looks.

Yes. Files like CLAUDE.md, AGENTS.md, SKILL.md or .cursorrules give instructions to AI coding tools. A malicious one can tell your AI to leak API keys or run commands without asking you. We read these files and flag the ones that try.

Most GitHub repos are safe, but some are malware dressed up as free tools. Warning signs include requests to turn off antivirus, password-protected zip files, brand-new accounts and repos that got thousands of stars in days.

No. We only read public information: the project page, the owner's profile, the main folder, the release notes, any AI instruction files (also in hidden folders like .claude/ and .cursor/) and the independent OpenSSF Scorecard security check. Your browser asks GitHub directly.

Uninstall it, run a full scan with your antivirus, and change the passwords you use on that computer, starting with email and banking. If it's a work computer, tell your IT team right away.

GitHub lets each visitor do about 8 checks an hour for free. If you hit the limit, wait a few minutes and try again. Some work networks also block GitHub, so try another connection.