ClonePeek v0.5.1 — Safer reports & JSON Schema v1

ClonePeek v0.5.1 is a maintenance release for the passive repository execution-surface scanner and reusable GitHub Action.

Improvements

• Safer evidence output: best-effort masking for common credential-bearing CLI options (including separate argument values), quoted assignments and HTTP Bearer authorization headers. Added redaction regressions for text, JSON and SARIF reports. The masking is NOT comprehensive: review reports for sensitive source data before sharing.
• Versioned JSON contract: published JSON Schema draft 2020-12 and an inert example. It describes required scan/finding fields and allows additive optional properties. The scanner version and schema version are separate. Valid JSON does NOT establish that a repository is safe.
• Packaging and documentation: updated pinned usage examples and release metadata, synchronized version checks, and included documentation, scanner demo fixtures and the GitHub Action adapter in the source distribution.
• Testing: 74 automated tests; hosted Linux, macOS and Windows Python CI and reusable GitHub Action jobs passed before release.

Install or run

Local CLI (requires Python 3.10+ and uv):

uvx --from git+https://github.com/harshitethic/clonepeek@v0.5.1 clonepeek /path/to/repo

GitHub Action (place in a workflow following actions/checkout):

- uses: harshitethic/clonepeek@v0.5.1
  with:
    path: .
    fail-on: none

The scanner does not execute the target repository's scripts; downloading the CLI or GitHub Action does use network access. This is a limited, heuristic review aid, not malware detection or a guarantee of safety.

JSON Schema: https://harshitethic.github.io/clonepeek/schema/scan-report-v1.schema.json
GitHub Action guide: https://github.com/harshitethic/clonepeek/blob/main/docs/GITHUB-ACTION.md
Threat model: https://github.com/harshitethic/clonepeek/blob/main/docs/THREAT_MODEL.md

The release includes an installable Python wheel and reproducible source archive. GitHub Marketplace listing is separate from this public GitHub release, and no independent user adoption is claimed.

ClonePeek v0.5.0 — Reusable GitHub Action

ClonePeek v0.5.0 — reusable GitHub Action

ClonePeek is an offline, read-only execution-surface inventory for unfamiliar repositories. It examines modeled npm lifecycle scripts, VS Code folder-open tasks, devcontainers, Claude Code and Cursor hooks, MCP process configs, and bounded explicit local shell-script references. It does not execute repository code or prove that a repository is safe.

New: use ClonePeek directly in GitHub Actions

- uses: actions/checkout@v4
  with:
    fetch-depth: 0
- uses: harshitethic/clonepeek@v0.5.0
  with:
    path: .
    fail-on: high
    format: sarif
    output: clonepeek.sarif

The composite action runs the scanner from the separate, versioned action checkout, using Python's standard library. It does not install dependencies from the repository being scanned. The workflow may fetch a Python runtime through GitHub's setup-python action; the scan itself makes no network requests.

Action capabilities

• Report-only by default (fail-on: none); optional low, medium, high, or critical threshold.
• Optional changed-since Git ref and reviewed fingerprint baseline.
• Text, JSON, and SARIF reports; optional private output file instead of full console report.
• Machine-readable finding counts and a GitHub job summary with counts only.
• Runnable on Windows, macOS, and Linux.

Verification

• 64 passing Python unit tests.
• Separate reusable-action GitHub CI smoke tests pass on Ubuntu, macOS, and Windows.
• 6/6 unit-test CI jobs pass across operating systems and Python 3.10/3.13.
• Wheel and source distribution builds verified.
• The 51-fixture synthetic evaluation is not a representative estimate of security detection accuracy. Known false positives and misses remain documented.

Try the CLI directly

uvx --from git+https://github.com/harshitethic/clonepeek@v0.5.0 clonepeek /path/to/repo

See the GitHub Action guide, limitations and threat model, and community discussions. Contributions with harmless, redacted reproducible examples are welcome.

Important: A finding is a review prompt, not a malware verdict. Reports may include sensitive source excerpts; review them before making artifacts public.

ClonePeek v0.4.1 — Correct changed-script diff scans

ClonePeek v0.4.1 — Correct changed-script PR reviews

Patch release addressing a changed-file scan blind spot. The v0.4.0 scanner added bounded, read-only inspection of local shell scripts explicitly referenced by npm/editor/agent execution hooks. --changed-since could previously miss a change made only to a script when its referencing configuration file remained unchanged.

Fix

• A tracked changed .sh file now triggers limited reinspection of unchanged recognized configurations for literal references to that script.
• If the configuration itself is unchanged, the diff-only report surfaces just the relevant changed script finding rather than reopening every previously known lifecycle finding.
• Tests cover an actual temporary Git repository in which only scripts/setup.sh changes from harmless text to a synthetic fetch-and-execute command using a reserved .invalid domain. Nothing is executed during the scan.
• 55 unit tests, a cross-platform Windows/macOS/Linux CI matrix, and the same bounded read-only implementation with symlink and path-escape defenses.

Run

uvx --from git+https://github.com/harshitethic/clonepeek@v0.4.1 clonepeek /path/to/repo
clonepeek /path/to/repo --changed-since HEAD --fail-on high

The second example expects a Git repository and uses tracked changes. Untracked files, shell-variable references, additional script hops, non-.sh script types and dynamic commands are outside its guarantee. The tool does not execute repository scripts or make security verdicts. These heuristics are not malware detection or proof that a repository is safe.

Read the full threat model · Contribute

ClonePeek v0.4.0 — Safe first-hop script review

ClonePeek v0.4.0 — See what a local install script contains

A tiny offline, read-only CLI to inventory commands that may run when opening a repo, installing its packages, or starting coding-agent hooks. ClonePeek does not execute repository commands, install project dependencies, contact the network during a scan, or provide a malware verdict.

Improvements

• One-hop local shell review: If a modeled execution trigger explicitly calls sh scripts/setup.sh, bash ./scripts/setup.sh, or a literal ./scripts/setup.sh, ClonePeek examines the local .sh text and can report risky commands at their actual script line, linked to the triggering configuration entry.
• Safety limits: at most 32 references per scan; 128 KiB and 2,000 lines per script. Paths outside the permitted scope, symlink escapes, oversized files and unreadable references generate coverage warnings rather than a clean verdict.
• Fully passive: Scripts are never run. No recursive script expansion, shell evaluation, symlink traversal, or network scanning.
• Documentation and regression coverage: An inert demonstration using .invalid addresses, tests including FIFO, symlinks, overflow and a no-execution sentinel, and updated threat-model limitations.
• 54 automated tests: CI tests Linux, macOS and Windows with Python 3.10/3.13. The existing 51-case hand-authored synthetic benchmark is distinct from these multi-file regression cases and must not be interpreted as real-world accuracy.

Try it

uvx --from git+https://github.com/harshitethic/clonepeek@v0.4.0 clonepeek /path/to/repo

In a checkout, run clonepeek examples/indirect-script to see the source-linking in action. The example command is never executed.

Boundaries

Plain-text .sh matches can be false positives (strings, comments within strings, unreachable branches). Dynamically computed paths, multiple hops, PowerShell scripts, other interpreters and many execution surfaces remain unsupported. Review all reports for sensitive excerpts before sharing. A scan is not a sandbox or safety guarantee. Threat model.

Repository · Contributing · Community discussions

ClonePeek v0.3.0 — Cursor hooks and real terminal demo

ClonePeek v0.3.0 — see what agent and editor hooks can run

Know what runs before you open an unfamiliar repository. ClonePeek is a local, read-only Python CLI with no runtime dependencies, no telemetry, and evidence-based findings—not a malware verdict.

New in v0.3.0

• Cursor project hooks: inspect .cursor/hooks.json for executable project-defined commands, including workspaceOpen, sessionStart, file-edit and agent events. Show trigger, file, source line and review guidance.
• Claude local hooks: inventory .claude/settings.local.json in addition to project settings.
• Honest demo: actual CLI output and a terminal preview from a combined Cursor/Claude example; only safe .invalid URLs are included. No sample commands are executed.
• Public smoke test: correctly reports seven medium command hooks from the public Cursor cookbook configuration. See reproduction and SHA-256. This is not a representative accuracy study.
• Correct SARIF version metadata: reflects the installed version.
• Tests and evaluation: 43 unit tests; a 51-case synthetic review-urgency evaluation with documented false positives/negatives. Those figures do not estimate performance on real repositories.

One-command start

uvx --from git+https://github.com/harshitethic/clonepeek@v0.3.0 clonepeek /path/to/repo

Or download the wheel/source archive attached to this release. Demo: clonepeek examples/agent-hooks from the source checkout.

Limits and safety

The scanner intentionally does not execute repository code or follow references into all nested scripts. It cannot prove a repository safe, and it may miss dangerous configurations or flag benign hooks as high urgency. Treat source excerpts and generated reports as potentially sensitive. Read the threat model before using this for security decisions.

Feedback and contributors

Open a reproducible issue for missed or overly severe hook classifications. Use redacted, inert examples only. Contributions should expand independent fixture coverage rather than claiming perfect detection. Discuss ideas.

ClonePeek v0.2.2 — measured synthetic evaluation and PowerShell detection

Fixed detection gap

A new regression reproduced a missed PowerShell fetch/execute form: iex (iwr URL).Content or Invoke-Expression (Invoke-WebRequest -Uri URL).Content previously had only medium review urgency. These expressions now classify critical. Static fixtures use .invalid URLs and never execute remote commands.

Measured labeled fixture evaluation

• 46 version-controlled, independently rationalized synthetic cases (up from 12), spanning 7 execution-surface rules and benign/suspicious Windows PowerShell examples.
• Threshold high: TP=15, FP=3, FN=2, TN=26. Fixture-only precision=83.3%, recall=88.2%.
• Rule-by-rule detection confusion, support, diagnostic Wilson intervals and safe nulls for unmeasurable statistics.
• Existing false positives (harmless folder-open tasks) and false negatives (indirect scripts) are retained and clearly documented.

These hand-authored scores must not be portrayed as real-world malware detection accuracy. ClonePeek remains an offline heuristic execution surface inventory, not a sandbox.

Verification

34 tests pass locally, and 12 PR GitHub checks pass across Ubuntu/macOS/Windows with Python 3.10 and Python 3.13. See docs/EVALUATION.md for reproducibility and limits.

ClonePeek v0.2.1 — Git helper execution hardening

Security fix

The previous --changed-since path used git diff --name-only with untrusted repository-local Git configuration. A malicious core.fsmonitor setting was reproduced executing a helper that wrote an unwanted marker.

This release disables filesystem monitor helpers, external diffs, repository hook dispatch, unsafe protocol configuration and inherited Git/SSH/environment overrides for changed-file filtering. Structured argv, ref validation and a 15-second timeout remain in place.

Verification

29 regression tests pass locally, including a real exploit reproduction; six GitHub Actions jobs passed on Linux, Windows and macOS across Python 3.10 and 3.13. See docs/GIT-CONFIG-ISOLATION.md for a grounded reproduction and remaining trust limits.

Limitations

ClonePeek is a heuristic offline scanner, not a Git sandbox or malware verdict. The installed Git binary still executes; no comprehensive Git security audit is claimed.

ClonePeek v0.2.0 — Agent Hooks & Honest Evaluation

ClonePeek v0.2.0 — Agent hook visibility and explicit evaluation

Know what runs before you open a repo. Read-only, local configuration scanning with no runtime Python dependencies.

What's new

• Claude Code hooks: inspect .claude/settings.json for type: command hooks, show lifecycle events, matchers and accurate source lines.
• Windows command heuristics: recognize PowerShell encoded commands, iwr | iex, and recursive Remove-Item usage.
• Safer static reads: bound actual file bytes, avoid symlink following where supported, refuse named pipes/devices, reject deeply nested JSON, and surface unreadable directories.
• Honest evaluation: 12 reproducible, hand-labeled synthetic fixtures; 6 TP, 1 FP, 1 FN, 4 TN at a high-risk cutoff (85.7% precision/recall on these examples only). A legitimate folder-open task is a false positive and indirect script execution remains a false negative.
• More verification: 27 unit tests, 6-platform/Python CI matrix, demonstration fixtures, and documented limitations.

Install and run

uvx --from git+https://github.com/harshitethic/clonepeek@v0.2.0 clonepeek /path/to/repo

Examples: clonepeek examples/suspicious and clonepeek examples/claude-hooks in a source checkout.

Review before trusting

ClonePeek is a static review aid, not proof that a repository is safe or malware-free. It does not execute repository-defined commands, install dependencies, send telemetry, follow transitive shell-script chains, or comprehensively model every development tool. Outputs may contain source snippets, so do not publish reports without review. See threat model and synthetic evaluation.

Contribute

We welcome safe fixtures, real reproducible false positives and missed execution paths. See issue #1 and issue #2. Do not report private credentials in public issues.

ClonePeek v0.1.0 — First Public Alpha

ClonePeek v0.1.0 — first public alpha

Know what runs before you open a repo. ClonePeek is a read-only, local Python CLI that inventories known execution-capable configuration in unfamiliar source trees, with no runtime Python dependencies.

Included

• VS Code folder-open auto-run tasks and suspicious shell evidence
• npm install/publish lifecycle hooks
• Devcontainer lifecycle commands and feature declarations
• Local MCP server launch configurations
• Human-readable, JSON, and SARIF 2.1.0 reports
• Git-diff filtering, fingerprint baselines, and severity-based exit codes
• Bounded scans that avoid symlinks, build dependencies, and vendor directories
• MIT license, threat model, contributor docs, example fixtures, and cross-platform automated tests

Quick start

uvx --from git+https://github.com/harshitethic/clonepeek@v0.1.0 clonepeek /path/to/repo

Or download the Python wheel or source archive from this release.

Important scope limitations

This is a static, heuristic execution-surface inventory, not a malware detector, sandbox, guarantee of safety, or complete analysis of transitive shell-script behavior. The scanner does not execute repository code. False positives and false negatives are expected. Opening or installing a repository can still be unsafe even if ClonePeek reports no findings.

Contributions: Help expand safe, reproducible fixture coverage and measured evaluation. See issue #1, issue #2, and docs/LAUNCH.md.