Check a repository before you install it

What it is for

AI assistants like Claude Code and Codex can install skills, plugins and tool connections (MCP servers) straight from GitHub. Each one can give your assistant new instructions, run actions automatically and reach your files and keys. A repository check reads one exact version of the repository and tells you, in plain words, whether to install it.

You don't need an account. Paste any of these into the box on the Lockpick home page or at Check:

• a repository link, like github.com/owner/repo
• a link to one folder or file in it, like github.com/owner/repo/tree/main/skills/pdf
• the install command the README gives you, like /plugin marketplace add owner/repo or npx skills add owner/repo
• just owner/repo
• a package, by its npm page like npmjs.com/package/name or its launch line like npx -y name or uvx name. Lockpick finds the GitHub repository the package names.

Lockpick reads the repository and never runs anything in it. Only public GitHub repositories can be checked for now.

No ownership proof

A Deep scan of a website needs proof that you own the site, because Lockpick sends requests to it. A repository check only reads public code and runs nothing in it, so it needs no proof: you can check any public repository, yours or someone else's.

What you get

At the top you get one of three answers: Do not install, Install with care or Nothing risky found. Below it, each finding says what could happen to you and what to do about it. Choose Technical to see the file and line, the evidence, and a prompt the author can paste into their coding assistant to fix it.

What it looks for

• Hidden text. Invisible characters, hidden comments and encoded text that people reading the file cannot see but your assistant still follows.
• Automatic actions. Claude Code hooks and settings that start commands on their own, send what you type somewhere else, or turn off the prompts that ask you first.
• Downloads that start themselves. Instructions or scripts that download a program and start it straight away, especially from unknown places.
• Tool connections. MCP servers that start whatever the newest version is, keep keys in plain text, or connect to unrelated servers.
• Instructions that take over. Text that tells your assistant to ignore your rules, hide what it is doing, or keep itself running after the session ends.
• Your keys and files. Code that reads keys, passwords or private files and sends them out.
• Packages. Known vulnerabilities, names made to look like popular packages, and installs from unofficial sources.

Apps

If the repository is an app rather than something you install, the check looks at what it does to anyone who opens it with an AI assistant: its .claude settings and hooks, MCP connections, CLAUDE.md and AGENTS.md, plus committed keys and packages. It does not review the app's own code for bugs. If the repository names its live site, you can check that site next.

Not the reading you expected? Choose Check it as an app instead, or the reverse, under What this is.

Watch a repository

Signed in, choose Watch this repository. Lockpick checks it again when it changes and tells you in the app only if a new version gets worse. Choose Stop watching when you no longer need it.

Your repositories

Signed in, every repository you check belongs to your workspace. Repos & skills in the app lists each one with its answer and when it was checked, so you can open the result, choose Check again or watch it. Filter the list by Skills, Plugins, MCP servers or Apps. Checks are kept for 30 days, and older ones are removed.

From your coding assistant

Ask your assistant to "check this repository with Lockpick before installing it". It uses lockpick_check_repository and reads the answer with lockpick_get_repository_check. From the terminal, run lockpicks check github.com/owner/repo.