soemoescode/guardskillRead-only scanner for what lets a repository run code in a coding agent (Claude Code, Codex, Cursor, Copilot): git settings, hooks, and committed MCP server definitions and agent settings. SARIF output. No dependencies, no network, no telemetry.
A repository can make your coding agent run code the moment it opens the folder. GuardSkill checks for that before you do.
npx guardskill .
Read-only. No network calls, no telemetry, no configuration, no account, no dependencies. It reads git configuration and hook scripts, prints what it found, and exits.
Coding agents gather context by running ordinary git commands — git status, git diff — as soon as they open a project. Git reads its settings from the repository's own .git/config, and roughly two dozen of those settings name a program for git to execute. Put a command in core.fsmonitor and it runs, with your privileges, outside any sandbox, before you have typed anything.
Two pieces of public research make this concrete:
.git/config is not transferred by a clone. The repository has to arrive as files with its .git directory already inside — a zip, a shared drive, a sync folder, a USB stick, an agent that unpacks an archive. (Manifold Security, The Hacker News)@github/copilot 1.0.43 by forcing safe.bareRepository=explicit. (GitHub Advisory)The recommended user-side mitigation in both write-ups is the same: inspect the git configuration before you open the directory with an agent. That is tedious to do by hand across a tree. This tool does it in a second.
The git vectors have one saving grace: the repository has to arrive as files, because a clone does not carry .git/config. Agent settings have no such requirement. A .mcp.json, a .claude/settings.json or a .vscode/mcp.json is an ordinary tracked file — it arrives with git clone like any other — and a coding agent reads it when it opens the project. An MCP server entry names a program and the agent starts it; a hook names a command and the agent runs it on an event; a permission setting can switch off the step where the agent asks you first.
How carefully these are configured in practice is worth one external number. Bloomberry measured 1,412 company-hosted MCP servers in February 2026 and found 38.7% with no authentication at all, up from 425 servers six months earlier. Those are public endpoints rather than the server definitions in your repository — a different population — but it is the same ecosystem, and it says something about how much care these configurations get. (Bloomberry)
One more thing worth saying plainly, without putting a number on it: the gap between "someone finds this" and "someone uses this" is closing, because the finding and the using are increasingly done by the same automated machinery. That is a reason to look before you open a directory, not a reason to panic about any particular line in a report — which is why GuardSkill does not attach a time-to-exploit claim to individual findings. It cannot know.
Every git configuration an agent could pick up, not only the obvious one: the project's own .git, any nested .git that arrived as content, any bare repository hidden in a subdirectory, the .git file a submodule or linked worktree leaves behind, config.worktree, every .git/modules/<name>/config, and any file pulled in through include.path that lies inside the tree.
And the agent settings files a repository can ship: .mcp.json anywhere in the tree, .claude/settings.json and settings.local.json, .vscode/mcp.json, .cursor/mcp.json, .gemini/settings.json, .windsurf/mcp.json. Both classes are found in one walk of the directory tree; the second one costs nothing extra.
The full list, key by key, with a source and a coverage status for each, is in rules/git-exec-keys-inventory.md. A test fails if that inventory and the rule set drift apart, so the list is auditable rather than aspirational. In summary:
| Class | Checks |
|---|---|
| Runs on ordinary commands | core.fsmonitor, core.pager, pager.<cmd>, core.editor, sequence.editor, diff.external, core.askPass, core.alternateRefsCommand |
| Runs on network operations | core.sshCommand, core.gitProxy, remote.<n>.uploadPack / receivePack, uploadpack.packObjectsHook |
Runs through .gitattributes | filter.<d>.clean / .smudge / .process, diff.<d>.textconv, merge.<d>.driver |
| Runs on demand | mergetool / difftool / browser / guitool / man .cmd, credential.helper, gpg.program, trailer.<t>.command, any alias.* that shells out or re-enters git with -c |
| Introduces settings later | include.path, includeIf.*.path (followed and inspected), init.templateDir |
| Transports that execute | protocol.allow, remote and submodule URLs using ext:: |
| Hooks | core.hooksPath, active scripts in .git/hooks, hook scripts that download or decode code, hook scripts that are symlinks |
| Structure | bare repositories in the tree, nested .git directories that are not registered submodules, directories named .git in a different case |
Four keys are deliberately out of scope, each with a reason in the inventory: sendemail.smtpServer, instaweb.httpd, ssh.variant and the HTTP proxy settings. That is why this README lists what it checks instead of claiming to cover a whole vulnerability class — a claim would only be true when that column is empty.
The second class, with its own inventory in rules/agent-settings-inventory.md and the same drift test behind it.
| Check | Severity |
|---|---|
An MCP server started from PATH (npx, uvx, node, docker) | low — informational. This is how most MCP servers are configured |
| The command is a path inside the tree, or an argument names a file inside it | high |
The command is a shell, downloads and runs code, or lives in /tmp or a hidden directory | critical |
A remote server declared with no credential material in headers or env | medium |
| A hook that runs a command on an agent event | the same ladder as above — npx prettier --write is informational, a script from the tree is high, a shell pipeline is critical |
A request to skip the approval step (bypassPermissions) | high, with the finding saying what the client actually does with it |
| A server entry in a shape the scanner does not recognise | medium — not understood is not the same as not there |
A wildcard in permissions.allow | high |
| A credential-shaped value | high |
If your own project ships its own MCP server, that entry is reported at high — GuardSkill cannot tell a repository you wrote from one you were handed. Use --fail-on critical, or --exclude the path.