octolabo/malskanner

malskanner is a security tool that checks a code repository for hidden instructions before an AI coding assistant, like Claude Code or Cursor, is allowed to read and act on it. The problem it addresses is that when you point an AI agent at a repository, the agent reads everything in it, including the README and comments, and a malicious repository could hide instructions in that text meant to hijack the agent, for example telling it to read your SSH keys or run a harmful command. These hidden instructions can be made invisible to a human reading the same file, using tricks like invisible characters, text that displays in a different order than it is stored, or content encoded so it only reveals itself when decoded. Running malskanner against a repository returns one of three verdicts: refuse, warn, or ok, along with the specific findings behind that verdict, such as an invisible instruction found at a particular line and what it decodes to. All of its detection is done with plain, predictable code rather than another AI model, so the tool itself cannot be tricked by the same hidden instructions it is looking for, and scanning the same repository twice always gives the same result. There is an optional feature that adds a second opinion from an AI model, but that model is only shown the text as plain data and is not given any tools to act with. You can run it directly with no installation using npx, install it globally, use it as a GitHub Action to block a pull request that introduces a hidden payload, or add it as an MCP tool so your AI agent can call it itself and check a repository before starting work on it. The README reports it was tested across 5,620 documentation files from well-known projects with zero false positives, while still catching intentional injection samples. It also supports marking specific lines as intentional examples so they are not flagged. The tool is written in TypeScript, requires Node version 20 or higher, and is licensed under the MIT License.