Is the Repo Forensics skill free?

Yes. The skill itself is free from alexgreensh/repo-forensics. SkillProof publishes the install command and an independent test verdict at no cost.

What is the Repo Forensics SkillProof Score?

9.6/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 9/10, docs & honesty 5/5.

How do I install Repo Forensics?

Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.

Can I use Repo Forensics with Cursor, Copilot, Gemini CLI, Codex or other AI tools?

The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.

Repo Forensics

Offline security scanner for repos, AI skills, plugins, and MCP servers

by alexgreensh · alexgreensh/repo-forensics

Tested · Works

Install — copy the command Download source ↗

Test report

Verdict: Tested · Works
Score: 9.6/10
Tested: Jul 17, 2026
Environment: Claude Code 2.x (agent harness)
Upstream re-checked: Aug 10, 2026 · d058363

Ran the bundled scanner live against a repo with a planted curl-pipe-to-shell exfil, a base64 exec payload, a prompt-injection SKILL.md and a committed .env: it returned 17 findings across 27 scanners, 9 CRITICAL, a deterministic BLOCK verdict and exit code 2, correctly correlating the credential-theft and exfiltration chains. The same scanner returned zero findings on a clean directory, so it earns its verdict rather than crying wolf, and works fully offline with hardened HTTPS-only threat-intel fetch.

Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works

Installs cleanly 5/5
Triggers reliably 5/5
Output vs. baseline 9/10
Docs & honesty 5/5

What Repo Forensics does

Deep, offline-first security audit for git repos, AI-agent skills, and MCP servers. Detects prompt injection, credential exfiltration, obfuscated code, runtime dynamism, manifest drift, and known CVEs/CISA-KEV vulns. Triggers when the user wants to vet code or a skill before installing it, or asks 'is this repo safe?' Not for fixing vulns or pentesting.

How to install Repo Forensics

git clone https://github.com/alexgreensh/repo-forensics
mkdir -p ~/.claude/skills
cd repo-forensics && cp -r skills/repo-forensics ~/.claude/skills/repo-forensics

Skills live in ~/.claude/skills/ (global) or .claude/skills/ (per-project). Restart Claude Code after installing.

Commands — how to trigger Repo Forensics

/repo-forensics Offline security scanner for repos, AI skills, plugins, and MCP servers

It also activates on plain-language prompts like these:

Scan this repo for prompt injection before I install it as a skill
Check whether this MCP server has any credential exfiltration code
Audit this plugin for supply-chain risks before we deploy it anywhere

Frequently asked questions

Is the Repo Forensics skill free?: Yes. The skill itself is free from alexgreensh/repo-forensics. SkillProof publishes the install command and an independent test verdict at no cost.
Does Repo Forensics work with Claude Code?: We tested it with Claude Code 2.x (agent harness) on Jul 17, 2026. Verdict: Tested · Works. Ran the bundled scanner live against a repo with a planted curl-pipe-to-shell exfil, a base64 exec payload, a prompt-injection SKILL.md and a committed .env: it returned 17 findings across 27 scanners, 9 CRITICAL, a deterministic BLOCK verdict and exit code 2, correctly correlating the credential-theft and exfiltration chains. The same scanner returned zero findings on a clean directory, so it earns its verdict rather than crying wolf, and works fully offline with hardened HTTPS-only threat-intel fetch.
What is the Repo Forensics SkillProof Score?: 9.6/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 9/10, docs & honesty 5/5.
How do I install Repo Forensics?: Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
Can I use Repo Forensics with Cursor, Copilot, Gemini CLI, Codex or other AI tools?: The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.