Skip to content
Agentmart
Submit a tool

repo-forensics

Security forensics for git repos, AI skills, and MCP servers.

Skill by Alex Greenshpun

IndexedNOASSERTION★ 196
Write a review

Install

Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install skill/alexgreensh-repo-forensics

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

Security forensics for git repos, AI skills, and MCP servers. Audits dependencies, detects prompt injection, credential theft, runtime dynamism, manifest drift, known CVEs, CISA KEV (actively exploited) vulns, and 2026 attack patterns. Not for fixing vulnerabilities or pentesting.

Use cases: security, agent-building

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.

Tools
No tools found
Secrets
None asked for
Install scripts
None found
Runs as
Python package

Network hosts it talks to 1

  • codeload.github.com · found in install command

Files it touches

  • ~/.claude/skills/repo-forensics

Tools it pre-approves 4

From allowed-tools in SKILL.md: the agent may use these without asking you each time.

  • Bash
  • Read
  • Glob
  • Grep

What's inside

Skill name
repo-forensics
Description
Security forensics for git repos, AI skills, and MCP servers. Audits dependencies, detects prompt injection, credential theft, runtime dynamism, manifest drift, known CVEs, CISA KEV (actively exploited) vulns, and 2026 attack patterns. Not for fixing vulnerabilities or pentesting.
License
NOASSERTION
Allowed tools
Bash, Read, Glob, Grep
Metadata
author: Alex Greenshpun
Instructions
560 lines in SKILL.md · view on GitHub

Before installing

  • Ships executable scripts
  • Pre-approves any shell command
  • Instructions call the network
  • Instructions read files in your home folder (~/.ssh, ~/.aws…)

Agent Skills spec issues

  • body: 560 lines (spec recommends under 500)

Files (88)

  • .gitignore
  • SKILL.md
  • checksums.json
  • checksums.json.sig
  • README.md · data/
  • compromised_versions.json · data/
  • rule_ids.csv · data/
  • .gitkeep · data/rulepacks/
  • dead_anchors.json · data/rulepacks/
  • mcp_security.json · data/rulepacks/
  • runtime_dynamism.json · data/rulepacks/
  • sast.json · data/rulepacks/
  • secrets.json · data/rulepacks/
  • shared.json · data/rulepacks/
  • skill_threats.json · data/rulepacks/
  • runtime_floors.json · data/
  • cryptominers.yar · data/yara/
  • hacktools.yar · data/yara/
  • malware.yar · data/yara/
  • manifest.json · data/yara/
  • webshells.yar · data/yara/
  • cursor-hook-contract.md · references/
  • kernel_privesc_sandbox_pack.md · references/
  • mcp-attack-patterns.md · references/
  • research_sources.md · references/
  • threat_patterns.md · references/
  • _context_gate.py · scripts/
  • _ed25519.py · scripts/
  • _pyc_unmarshal.py · scripts/
  • _shared_patterns.py · scripts/
  • adjudication.py · scripts/
  • adjudication_bridge.py · scripts/
  • aggregate_json.py · scripts/
  • auto_scan.py · scripts/
  • corpus_sync.py · scripts/
  • cursor_pre_scan.py · scripts/
  • dast_sandbox.sb · scripts/
  • dead_anchors_extract.py · scripts/
  • dead_anchors_probe.py · scripts/
  • forensics_core.py · scripts/
  • gen_rule_ids.py · scripts/
  • hook_adapter.py · scripts/
  • ioc_manager.py · scripts/
  • parse_pnpm_lock.py · scripts/
  • pre_scan.py · scripts/
  • pypi_pins.py · scripts/
  • refresh_controller.py · scripts/
  • refresh_threat_dbs.py · scripts/
  • rule_loader.py · scripts/
  • rulepack_feed.py · scripts/
  • run_forensics.sh · scripts/
  • sarif_export.py · scripts/
  • scan_agent_skills.py · scripts/
  • scan_archive.py · scripts/
  • scan_ast.py · scripts/
  • scan_binary.py · scripts/
  • scan_bytecode.py · scripts/
  • scan_dast.py · scripts/
  • scan_dataflow.py · scripts/
  • scan_dead_anchors.py · scripts/
  • …and 28 more

The license isn't open source, so the instructions aren't shown here. Read SKILL.md on GitHub

More from alexgreensh/repo-forensics

Signals

Stars
196
Forks
28
Open issues
1
Last commit (this folder)
Oct 23, 2026 (3 days ago)
Last release
Oct 23, 2026 (3 days ago)

From GitHub (fetched Oct 24, 2026).

Details

License
NOASSERTION
Repository
github.com/alexgreensh/repo-forensics
First seen
Oct 24, 2026
Last checked
Oct 24, 2026
Source
GitHubgithub-graphql

Same skill elsewhere

Copies of this SKILL.md published by others; search shows only one of them.

More from Alex Greenshpun

Cite this page

repo-forensics skill. Agent Mart. https://agentmart.dev/skills/alexgreensh-repo-forensics (last updated 2026-10-24)