Check any GitHub repository before you install it
What the code can do, signs of malware, and tricks in install scripts. Read, never run.
- Paste a public GitHub link
- vetcode reads the code. Nothing is installed, built or run
- Get a label of what it can do, findings, and a badge
Questions
Does OpenYard run the code it checks?
No. The repository is downloaded as an archive and read by vetcode. Nothing is installed, built or executed, so checking a malicious repository is safe.
What does the check look for?
Signs of malware and stealers, tricks in install scripts and build hooks, hidden or encoded code, and risky CI or AI agent setup. It also lists what the code can do: read secrets, connect to the internet, start other programs, read user and machine details.
Does a clean result mean the repository is safe?
It means the scanner found no known malicious patterns. Patterns are not proof either way. For a decision that matters, ask your AI agent to review it with the vetcode skill: it reads the code around each finding and looks for what rules cannot see.
How much does it cost?
Nothing. OpenYard and vetcode are free and open source.