repo-explorer — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited repo-explorer (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Launch a separate Claude Code CLI process (claude -p --model haiku) with read-only tools to explore a repository and answer questions about it. Supports both local repositories and remote URLs.
From the user's message extract:
~/projects/foo, /opt/services/bar, . or omitted = cwd)https://github.com/owner/repo, [email protected]:owner/repo.git)owner/repo — treat as https://github.com/owner/repo)If the source is a remote URL or shorthand, clone it first:
REPO_DIR=$(mktemp -d) && git clone --depth 1 <url> "$REPO_DIR" && echo "$REPO_DIR"--depth 1 for speed (shallow clone, only latest commit)git clone --depth 1 --branch <ref> <url> "$REPO_DIR"$REPO_DIR to clean up laterUse the Bash tool with timeout: 600000 (10 min) since exploration of large repos can take several minutes.
cd <repo_path> && CLAUDECODE= claude -p "<question>" \
--model haiku \
--output-format text \
--max-turns 15 \
--allowedTools "Read" "Grep" "Glob" "Bash(find *)" "Bash(ls *)" "Bash(wc *)" "Bash(git log *)" "Bash(git show *)" "Bash(git diff *)" "Bash(git branch *)" "Bash(head *)" "Bash(tail *)" \
--append-system-prompt "You are a code exploration expert. Thoroughly explore the repository to answer the user's question. Strategy: 1) Glob to discover project structure. 2) Grep to find patterns, definitions, routes, classes. 3) Read to examine key files. Always cite file paths and line numbers. Give a structured answer based on code facts."IMPORTANT: The CLAUDECODE= prefix (setting the env var to empty) is required to allow launching Claude Code as a subprocess. Without it, the nested session will be blocked.
Rules:
CLAUDECODE= directly before claude -p (no &&, it's an inline env override)\"--max-turns to 25--model haikuAfter presenting the result, remove the temp directory:
rm -rf "$REPO_DIR"Display the CLI output to the user. If empty or error, report the issue and suggest retrying with a more specific question.
Local repo:
cd ~/projects/my-api && CLAUDECODE= claude -p "What REST endpoints are defined? List each with HTTP method, path, and handler." --model haiku --output-format text --max-turns 15 --allowedTools "Read" "Grep" "Glob" "Bash(find *)" "Bash(ls *)" "Bash(wc *)" "Bash(git log *)" "Bash(git show *)" "Bash(git diff *)" "Bash(git branch *)" "Bash(head *)" "Bash(tail *)" --append-system-prompt "You are a code exploration expert. Thoroughly explore the repository to answer the user's question. Strategy: 1) Glob to discover project structure. 2) Grep to find patterns, definitions, routes, classes. 3) Read to examine key files. Always cite file paths and line numbers. Give a structured answer based on code facts."Remote repo (GitHub URL):
REPO_DIR=$(mktemp -d) && git clone --depth 1 https://github.com/expressjs/express "$REPO_DIR"Then:
cd "$REPO_DIR" && CLAUDECODE= claude -p "How is routing implemented? Describe the Router class and middleware chain." --model haiku --output-format text --max-turns 15 --allowedTools "Read" "Grep" "Glob" "Bash(find *)" "Bash(ls *)" "Bash(wc *)" "Bash(git log *)" "Bash(git show *)" "Bash(git diff *)" "Bash(git branch *)" "Bash(head *)" "Bash(tail *)" --append-system-prompt "You are a code exploration expert. Thoroughly explore the repository to answer the user's question. Strategy: 1) Glob to discover project structure. 2) Grep to find patterns, definitions, routes, classes. 3) Read to examine key files. Always cite file paths and line numbers. Give a structured answer based on code facts."Then: rm -rf "$REPO_DIR"
Shorthand (owner/repo): treat vercel/next.js as https://github.com/vercel/next.js.
Current directory (no path): run claude -p without cd.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.