vet-repo -- Repository Agent Config Scanner
Scan all agent configuration files in a repository for known malicious patterns. Use this when entering an unfamiliar codebase to assess agent-level security risks before trusting the repo's configurations.
What to do
Run the scanner script against the current project root:
CODEBLOCK0
Where $SKILL_DIR is the directory containing this SKILL.md, and $PROJECT_ROOT is the root of the repository being scanned.
What it scans
- -
.claude/settings.json -- hook configs (auto-approve, stop loops, env persistence) - INLINECODE3 -- all SKILL.md files (hidden comments, curl|bash, persistence triggers)
- INLINECODE4 -- MCP server configs (unknown URLs, env var expansion, broad tools)
- INLINECODE5 /
.claude/CLAUDE.md -- instruction injection in project config
Output
Structured report with findings grouped by severity (CRITICAL, HIGH, MEDIUM, LOW, INFO) and actionable recommendations for each finding.
When to use
- - Before trusting a cloned repository's agent configurations
- After pulling changes that modify
.claude/ or INLINECODE8 - As part of a security review of any codebase with agent integration
Advisory hooks
This repository includes PreToolUse hooks in .claude/settings.json that warn on
dangerous Bash commands (pipe-to-shell, rm -rf /, chmod 777, eval with variables,
base64-to-execution) and sensitive file writes (.ssh/, .aws/, .gnupg/, shell
profiles, settings.json).
These hooks are advisory only -- they produce warning messages but do not block
execution. An agent or user can proceed past the warning.
- - The hooks are a supplementary signal, not an enforcement layer
- vet-repo is the primary detection mechanism for repo-level threats
- Deterministic blocking requires changing the hook to return
{"decision": "block"} instead of a warning message
- - See
.claude/settings.json for the current hook definitions
vet-repo —— 仓库代理配置扫描器
扫描仓库中所有代理配置文件，查找已知的恶意模式。在信任仓库配置之前，进入不熟悉的代码库时使用此工具，以评估代理层面的安全风险。
操作步骤
针对当前项目根目录运行扫描脚本：
bash
python3 $SKILLDIR/scripts/vetrepo.py $PROJECT_ROOT
其中 $SKILLDIR 是包含此 SKILL.md 文件的目录，$PROJECTROOT 是被扫描仓库的根目录。
扫描内容
- - .claude/settings.json —— 钩子配置（自动批准、停止循环、环境持久化）
- .claude/skills/ —— 所有 SKILL.md 文件（隐藏注释、curl|bash、持久化触发器）
- .mcp.json —— MCP 服务器配置（未知 URL、环境变量展开、宽泛工具）
- CLAUDE.md / .claude/CLAUDE.md —— 项目配置中的指令注入
输出结果
结构化报告，按严重级别（严重、高、中、低、信息）对发现结果进行分组，并为每个发现提供可操作的建议。
使用时机
- - 在信任克隆仓库的代理配置之前
- 在拉取修改了 .claude/ 或 .mcp.json 的变更之后
- 作为任何包含代理集成的代码库安全审查的一部分
建议性钩子
此仓库在 .claude/settings.json 中包含 PreToolUse 钩子，用于对危险的 Bash 命令（管道到 shell、rm -rf /、chmod 777、带变量的 eval、base64 到执行）和敏感文件写入（.ssh/、.aws/、.gnupg/、shell 配置文件、settings.json）发出警告。
这些钩子仅为建议性——它们会生成警告消息，但不会阻止执行。代理或用户可以忽略警告继续操作。
- - 钩子是一种补充信号，而非强制执行层
- vet-repo 是检测仓库级威胁的主要机制
- 确定性阻止需要将钩子改为返回 {decision: block} 而非警告消息
- 当前钩子定义请参见 .claude/settings.json
