Skip to content

ClonePeek v0.4.0 — Safe first-hop script review

Choose a tag to compare

View all tags
@harshitethic harshitethic released this 15 Oct 08:14
· 34 commits to main since this release
v0.4.0
2ab76cc
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ClonePeek v0.4.0 — See what a local install script contains

A tiny offline, read-only CLI to inventory commands that may run when opening a repo, installing its packages, or starting coding-agent hooks. ClonePeek does not execute repository commands, install project dependencies, contact the network during a scan, or provide a malware verdict.

Improvements

  • One-hop local shell review: If a modeled execution trigger explicitly calls sh scripts/setup.sh, bash ./scripts/setup.sh, or a literal ./scripts/setup.sh, ClonePeek examines the local .sh text and can report risky commands at their actual script line, linked to the triggering configuration entry.
  • Safety limits: at most 32 references per scan; 128 KiB and 2,000 lines per script. Paths outside the permitted scope, symlink escapes, oversized files and unreadable references generate coverage warnings rather than a clean verdict.
  • Fully passive: Scripts are never run. No recursive script expansion, shell evaluation, symlink traversal, or network scanning.
  • Documentation and regression coverage: An inert demonstration using .invalid addresses, tests including FIFO, symlinks, overflow and a no-execution sentinel, and updated threat-model limitations.
  • 54 automated tests: CI tests Linux, macOS and Windows with Python 3.10/3.13. The existing 51-case hand-authored synthetic benchmark is distinct from these multi-file regression cases and must not be interpreted as real-world accuracy.

Try it

uvx --from git+https://github.com/harshitethic/clonepeek@v0.4.0 clonepeek /path/to/repo

In a checkout, run clonepeek examples/indirect-script to see the source-linking in action. The example command is never executed.

Boundaries

Plain-text .sh matches can be false positives (strings, comments within strings, unreachable branches). Dynamically computed paths, multiple hops, PowerShell scripts, other interpreters and many execution surfaces remain unsupported. Review all reports for sensitive excerpts before sharing. A scan is not a sandbox or safety guarantee. Threat model.

Repository · Contributing · Community discussions

Assets 4
Loading