Show HN: Soothsay - Your AI types curl | sh. soothsay checks the script first

Category: security

Tags: security, shell, static-analysis, installer, ai-agent, rust

Score: 7.8/10 (Innovation: 7, Technical: 8, Documentation: 9, Utility: 7)

Soothsay is a Rust CLI that analyzes shell install scripts (like those from curl | sh) and reports in plain English what they will do, flagging risky behaviors such as appending to shell configs, downloading remote code, accessing secrets, or weakening security. It integrates as a Claude Code hook to block AI agents from piping installers without review, and offers features like behavior diffing, cloak-check for server-side differentiation, and policy enforcement for CI. The project addresses a real security gap with a focused, zero-dependency implementation and thorough documentation.

Target audience: developers, devops, security engineers, AI coding agent users

Repository: https://github.com/rijuld/soothsay · Rust · MIT · 3 stars

View on Hacker News