Lazaretto

Verify a third-party skill, tool, or npm/GitHub package for malicious behavior BEFORE you install or run it. Free known-bad hash lookup plus a deterministic scan for credential theft, exfiltration, obfuscation, prompt injection, install-time droppers, and bundled secrets — with evidence. Scan by content hash, npm package, GitHub repo, raw URL, or ClawHub skill, then re-verify the on-disk bytes match what was scanned. Use before installing any untrusted skill or dependency.

by @jamesdfinance-dev·MIT-0