digitalfortressaudit

Agent Repo Preflight — Development skill for Claude Code

Development community

Read-only preflight for cloned repos: inventories AGENTS.md, CLAUDE.md, .cursorrules and MCP/hook configs, and flags hidden Unicode, install and curl-pipe-shell lines, and auto-approve settings before.

How to install Agent Repo Preflight

This entry records only its repository, not the path inside it, so there is no exact command to give. Open digitalfortressaudit/agent-repo-preflight and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Agent Repo Preflight does

Alternatives in Development

Param Discover — Discover hidden HTTP parameters on a URL or list of URLs using Arjun (or x8 fallback) 4.5k ★
Obsidian Emerge — Surface unnamed patterns from your recent notes — recurring themes, hidden connections, and conclusions you ha 277 ★
Edit Image — This command edits existing images based on provided edit prompts using Replicate's API directly via curl 201 ★

README

agent-repo-preflight: read-only pre-open check for AGENTS.md, rule files, MCP and hook configs

Flags hidden Unicode, package-install and curl-pipe-shell lines, auto-approve settings, MCP command entries and hooks before a coding agent loads them.

Read a freshly cloned repository and inventory the agent rule files and repo-declared MCP or hook config before you open that repository in a coding agent. One read-only Python script. The standard library is enough.

Use it on repositories you own or are explicitly allowed to review.

mcp-tool-pin-check pins live MCP tool descriptions. agent-k8s-harden-check reads Kubernetes manifests. This checker reads rule files and repository config that a coding agent may load on open.

Why it matters

Coding agents load repository instruction files and repository-declared tool config when a project is opened. Two public sources are the reason this checker exists:

The PackHallu paper studies AGENTS.md, CLAUDE.md, and .cursorrules as files that can change which package a coding agent selects. This repository does not include prompts from that paper. The checker flags install instructions and, when you pass an allowlist, package names that are not on it.
The Injection's week 42 roundup (12–18 October 2026) describes coding agents loading MCP config and hooks that a repository declares. This checker inventories those files and flags command entries and hook definitions.

Those are links to the public pages. This repository does not restate procedures from them. It reads the files you already have and reports the patterns below.

Quick start

Requires Python 3.9 or newer.

git clone https://github.com/digitalfortressaudit/agent-repo-preflight.git
cd agent-repo-preflight
python3 agent_repo_preflight.py /path/to/cloned/repo

From that directory, the same flags are available on the script: