Check a code project is safe before you install it
Sarvar Nadaf built RepoPilot, an agent that reads any public GitHub project, scores it 0 to 100 for safety and trust, and flags risky install steps.
Done with Custom agentAmazon Nova Pro
What they did
Sarvar Nadaf built RepoPilot after reports of thousands of fake GitHub projects posing as AI add-ons. You give it a project name and it reads the real files. Plain code scores safety, trust, upkeep, maturity and documentation. A cheap AI model then narrates the result and lays out setup steps.
How it went
The author says a scan takes a minute or two. Ollama, a legitimate tool, dropped to a D because of its install command, which he calls a fair warning, not a malware verdict. The project has 25 tests and a live demo.
Worth knowing
The author kept the AI out of the scoring on purpose, so the model cannot talk a risky project into looking safe. His first scanner wrongly flagged Flask until he taught it to ignore local addresses.
Try it yourself
Before I install anything from [GitHub project URL], inspect it for me. Read the README, install scripts, package files and recent activity. Flag any setup step that downloads and runs remote code, any install hooks, and any signs of fake popularity like many stars on a very new account. Give the project a 0-100 trust score with reasons for each point lost. Then list the safest step-by-step way to get a first run working. Do not run any commands yourself; show me the plan and wait for my approval.Swap the highlighted [parts] for your own details.
Source: DEV Community · Sarvar Nadaf · Oct 19, 2026
Written with AI assistance from the original post and checked against our editorial guidelines. Results are as reported by the source, not independently verified. Spotted a mistake? Tell us.
