Show HN: Autorun-audit – find what runs when you open, CD into or install a repo

Category: security

Tags: security-audit, static-analysis, supply-chain-security, editor-config, ai-agents, python

Score: 6.8/10 (Innovation: 6, Technical: 7, Documentation: 8, Utility: 6)

autorun-audit is a static scanner that identifies code which executes automatically when a repository is opened, cloned, or installed—covering VS Code tasks, Claude/Cursor hooks, MCP servers, devcontainer commands, .pth files, and more. It fills a real security gap left by the rise of editor- and agent-driven auto-execution, catching threats before they run.

Target audience: security engineers, backend developers, devops

Repository: https://github.com/ag3ntsc4rn/autorun-audit · Python · MIT

View on Hacker News