{"slug": "repository-hooks-to-inspect-before-trusting-a-github-project", "title": "Repository hooks to inspect before trusting a GitHub project", "summary": "A developer released ClonePeek, an MIT-licensed Python CLI and GitHub Action that statically enumerates configuration-defined command entry points in an unfamiliar repository before a user installs dependencies, opens it in a trusted editor workspace, or attaches a coding agent. The tool reads bounded config files such as package.json lifecycle scripts, .vscode/tasks.json folderOpen tasks, devcontainer lifecycle commands, and Claude/Cursor hook and MCP server definitions, without executing the target repository's scripts. The author stresses that finding a command in a file is not proof it ran, and that cloning itself is not a sandbox.", "body_md": "Opening a folder, installing dependencies, attaching a coding agent, or launching a devcontainer can activate configuration-defined commands. Here is a short checklist for finding the known entry points before you decide what to trust.\n\nRepository configuration can describe what a development tool *may* run later. Seeing a command in a file is not proof that it executed, that the author is malicious, or that the project is compromised. Triggers depend on individual package-manager, editor, trust and agent settings.\n\nReview an unfamiliar checkout from a separate trusted terminal **before** installing its packages, opening it as a trusted editor workspace, or starting a coding agent. Even cloning is not a sandbox: your local Git configuration and environment may affect Git operations.\n\nLook in `package.json`, especially the `scripts` keys `preinstall`, `install`, `postinstall`, `prepare` and `prepack`. Some package-manager operations can invoke these automatically. A normal lifecycle command is not inherently suspicious; check the script and the programs it calls.\n\n```\n{\n  \"scripts\": {\n    \"postinstall\": \"node scripts/verify-setup.js\"\n  }\n}\n```\n\nThis is an **inert illustration**. Do not execute it to inspect it. ClonePeek models these npm surfaces and follows one statically identifiable hop into literal local `.sh` references, but it does not analyze arbitrary JavaScript imports or recursive script execution.\n\nInspect `.vscode/tasks.json` for tasks that declare `runOptions.runOn: folderOpen`. Whether a task runs when the folder is opened depends on workspace trust and automatic-task settings. Read the command, task arguments and referenced files before accepting the workspace.\n\n```\n{\n  \"version\": \"2.0.0\",\n  \"tasks\": [{\n    \"label\": \"Example setup task\",\n    \"type\": \"shell\",\n    \"command\": \"echo review-me\",\n    \"runOptions\": {\"runOn\": \"folderOpen\"}\n  }]\n}\n```\n\nThe `echo` value is deliberately harmless; this snippet exists to demonstrate the configuration shape, not to perform a setup.\n\nReview `.devcontainer/devcontainer.json` for `initializeCommand`, `onCreateCommand`, `postCreateCommand`, `postStartCommand` and `postAttachCommand`. Those correspond to different phases of creating, starting and attaching to a development environment. Devcontainer features can also introduce build-time setup. An isolated container is not a blanket guarantee of safety when it has mounts, credentials or network access.\n\nLook at project files such as `.claude/settings.json` and `.claude/settings.local.json`. Command hooks can be attached to events such as `SessionStart` or `PostToolUse`. Activation depends on the agent and its configuration. Treat instructions, tools and automatic commands from a new project as untrusted until reviewed.\n\nLook for `.cursor/hooks.json`, including event definitions such as `workspaceOpen` and `afterFileEdit`. Read *what will be invoked, when, and by which process*. A passive review tool should never trigger the hook merely to discover its output.\n\nReview the local MCP configuration your agent or editor may consume, particularly each `mcpServers` entry with a `command`, `args`, environment variables and filesystem references. These are process-launch instructions, not necessarily running servers. They may take effect only when the client enables or approves them.\n\nI maintain [ClonePeek](https://github.com/harshitethic/clonepeek), a small MIT-licensed Python CLI and GitHub Action for enumerating the modeled entry points above. The scan reads bounded configuration files and does **not** run the target repository's scripts. Downloading/installing the scanner itself uses a network connection; the scan itself operates offline.\n\n```\nuvx --from git+https://github.com/harshitethic/clonepeek@v0.5.1 clonepeek /path/to/repo\n```\n\nFor an inert demonstration, use the bundled [agent-hooks fixture](https://github.com/harshitethic/clonepeek/tree/main/examples/agent-hooks). Review the **trigger** , source **path and line** , example **evidence** , and suggested review advice for each finding. None of the example commands needs to run.\n\nYou can also start with this non-blocking PR workflow:\n\n```\nname: Review execution hooks\non: [pull_request]\npermissions:\n  contents: read\njobs:\n  scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: harshitethic/clonepeek@v0.5.1\n        with:\n          path: .\n          fail-on: none\n```\n\nThe [Action integration guide](https://github.com/harshitethic/clonepeek/blob/main/docs/GITHUB-ACTION.md) explains thresholds, baselines, JSON/SARIF and changed-file mode.\n\nHave a harmless repository hook that is missing or misclassified? A tiny inert reproduction and clear expected trigger help more than generic praise. The public [threat model](https://github.com/harshitethic/clonepeek/blob/main/docs/THREAT_MODEL.md) lists blind spots, and the [labeled synthetic evaluation](https://github.com/harshitethic/clonepeek/blob/main/docs/EVALUATION.md) is explicitly **not** independent real-world accuracy evidence.\n\n[Contribute an inert field test ↗](https://github.com/harshitethic/clonepeek/issues/14) [Get the stable release ↗](https://github.com/harshitethic/clonepeek/releases/tag/v0.5.1) [Explore ClonePeek ↗](https://harshitethic.github.io/clonepeek/)\n\n*Disclosure: I maintain ClonePeek. This DEV cross-post was prepared with AI assistance from my original, publicly available technical guide and is not an independent endorsement. See the repository threat model for the exact scan boundaries.*", "url": "https://wpnews.pro/news/repository-hooks-to-inspect-before-trusting-a-github-project", "canonical_source": "https://dev.to/harshitethic/repository-hooks-to-inspect-before-trusting-a-github-project-28p4", "published_at": "2026-10-18 03:59:03+00:00", "updated_at": "2026-10-18 04:10:06.685278+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "ai-safety"], "entities": ["ClonePeek", "GitHub", "Claude", "Cursor", "npm", "Visual Studio Code"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/repository-hooks-to-inspect-before-trusting-a-github-project", "markdown": "https://wpnews.pro/news/repository-hooks-to-inspect-before-trusting-a-github-project.md", "text": "https://wpnews.pro/news/repository-hooks-to-inspect-before-trusting-a-github-project.txt", "jsonld": "https://wpnews.pro/news/repository-hooks-to-inspect-before-trusting-a-github-project.jsonld"}}