shaojun-666

Gitspawn Scan — AI skill for Claude Code

AI community

Scan a folder before your AI coding agent opens it.

How to install Gitspawn Scan

This entry records only its repository, not the path inside it, so there is no exact command to give. Open shaojun-666/gitspawn-scan and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Gitspawn Scan does

Scan a folder before your AI coding agent opens it. Finds the git config, hooks and agent settings that execute code the moment an agent touches the directory.

Alternatives in AI

Swift Agent Skills — A curated directory of open-source AI agent skills for Swift and Apple platform development 1.5k ★
Coffee CLI — A clean AI terminal workspace 180 ★
Engram — The context spine that 10x's every AI coding session 141 ★

README

gitspawn-scan

[English](README.md) | [简体中文](README.zh-CN.md)

[![test](https://github.com/shaojun-666/gitspawn-scan/actions/workflows/test.yml/badge.svg)](https://github.com/shaojun-666/gitspawn-scan/actions/workflows/test.yml)

**A folder can run code at you before your AI agent finishes opening it. Check first.**

npx github:shaojun-666/gitspawn-scan ~/Downloads/that-repo-someone-sent-me

One command. No dependencies, nothing to install, no npm package in the middle.

What happens without it

Someone sends you a zip. You unpack it, open it up, and tell Claude Code to take a look at the project.

At that moment a program may already have run on your machine, and you did not write it.

You did not click anything, and nothing asked you for permission. What triggered it was a `git status` — the first thing an agent runs to orient itself. That git command reads the repository's own `.git/config` and executes a program named in there.

The awkward part is where the execution happens: inside git, below the agent's tool layer. So there is no tool call for the agent to approve, no sandbox in the way, and in some agents it fires before the workspace-trust prompt is even answered. By the time you think to check, there is nothing left to check.

Where this came from

Manifold Security disclosed the class in September 2026 and named it GitSpawn ([write-up](https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html)). Eight findings across seven agents: Claude Code, Codex, Cursor, Goose, Hermes Agent, Qwen Code and Grok Build. Several were still unpatched weeks later.

The mitigation they published was to look by hand:

git config --get core.fsmonitor

Sound advice. It just covers one key, and one repository at a time.

gitspawn-scan does the whole check: every configuration key in that family, plus a category nothing else looks at — the agent's own configuration files.