sindresorhus/execa
What the code can do, signs of malware, and tricks in install scripts. Read, never run.
Code check
Read by vetcode without running anything, at the commit below. Check again any time.
247faa0- Malware and stealers
- Install scripts and hooks
- Hidden or encoded code
- CI and AI agent setup
What the code can do
- Reads secrets or environment variables16 files
- Connects to the internet1 file
- Starts other programs172 files
- Reads user and machine details1 file
[](https://openyard.cloud/check/sindresorhus/execa)
Patterns, not proof: a finding is a reason to read the code, not a verdict on the maker. Vulnerability candidates and leaked-secret locations are not published here.
Go deeper with your AI agent
The check above is the scanner on its own. Your agent, with the vetcode skill, reads the code around each finding, throws out false alarms and looks for what rules cannot see, such as missing permission checks or broken logic.
claude plugin marketplace add openyard-cloud/vetcode && claude plugin install vetcode@openyardInstalls vetcode as a plugin, once per machine.
Use the vetcode skill to review https://github.com/sindresorhus/execa before I install it. Download it into a temporary folder and do not run, install or build anything from it. Read the code around every finding to confirm or rule it out, then look for what patterns cannot catch. Finish with a plain answer: safe to install, or not, and why.
npx skills add openyard-cloud/vetcodeAdds the vetcode skill where Codex looks for skills.
Use the vetcode skill to review https://github.com/sindresorhus/execa before I install it. Download it into a temporary folder and do not run, install or build anything from it. Read the code around every finding to confirm or rule it out, then look for what patterns cannot catch. Finish with a plain answer: safe to install, or not, and why.
npx skills add openyard-cloud/vetcodeThe skills CLI knows where each agent keeps its skills.
Use the vetcode skill to review https://github.com/sindresorhus/execa before I install it. Download it into a temporary folder and do not run, install or build anything from it. Read the code around every finding to confirm or rule it out, then look for what patterns cannot catch. Finish with a plain answer: safe to install, or not, and why.