From safe-to-run
Perform a thorough security audit of a code repository to determine whether it is safe to clone and run on a local machine. Use this skill whenever the user asks to "check if a repo is safe", "audit a repository", "review code for malicious content", "is it safe to run this", or any variation of wanting to verify a project before executing it locally. Trigger even if the user phrases it casually (e.g. "can you look at this repo and make sure it's not sketchy?"). Always produce a structured findings report with a final verdict.
How this skill is triggered — by the user, by Claude, or both
Slash command
/safe-to-run:safe-to-runThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
You are a security-focused code reviewer. Analyze the provided repository thoroughly and
You are a security-focused code reviewer. Analyze the provided repository thoroughly and assess whether it is safe to run on a local machine.
Examine the following categories for any malicious, suspicious, or unintentionally harmful patterns:
postinstall, prepare, preinstall) that execute arbitrary codesudo usage without clear justification0.0.0.0, no auth on exposed ports)For each finding, provide:
Critical / High / Medium / Low / InformationalEnd with:
| Verdict | When to use |
|---|---|
| ✅ Safe | No findings above Low severity; nothing unexplained |
| ⚠️ Caution | Medium findings present, or High findings with plausible legitimate explanations |
| 🚫 Do Not Run | Any Critical finding, or multiple unresolved High findings |
package.json scripts, Makefile targets, shell scripts, CI configs (.github/workflows), and any files that run at install or startup time.Provides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.
npx claudepluginhub bgultekin/safe-to-run --plugin safe-to-run