Audits a third-party or freshly cloned repo before install or run for install hooks, auto-run files, CVEs, typosquats, and malicious code, graded A-F with a safe-to-run verdict. Use when asked whether a clone is safe to run, or to audit or scan a third-party repo. Not for security review of the user's own code; use reviewing-code.
Install
npx skills add bostonaholic/skills --skill auditing-repo-securitynpx skills add bostonaholic/skills --skill auditing-repo-security -a claude-code -gnpx skills add bostonaholic/skills --skill auditing-repo-security -a codex -ggemini skills install https://github.com/bostonaholic/skills.git --path skills/engineering/auditing-repo-securitygh skill install bostonaholic/skills auditing-repo-securitygit clone --depth 1 https://github.com/bostonaholic/skills /tmp/bostonaholic__skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/bostonaholic__skills/skills/engineering/auditing-repo-security ~/.claude/skills/auditing-repo-security # Claude Code
cp -R /tmp/bostonaholic__skills/skills/engineering/auditing-repo-security ~/.agents/skills/auditing-repo-security # Codex, Cursor, Gemini CLI, Copilot, OpenCode