sandbox-source-intake
Safely clone, inspect, and triage fresh GitHub repos without overusing disk or running risky code. Use when the user asks to clone many repos, evaluate bleeding-edge tools, install MCP servers, run un
Files1
View on GitHubSKILL.mdskills/sandbox-source-intake/SKILL.md
GitHubSandbox Source Intake
Use this before trusting a fresh repo.
Clone Policy
- Use shallow clones:
git clone --depth 1 <url> sources/<name>. - Prefer a small curated set over bulk cloning.
- Check
du -sh sourcesafter each batch. - Skip or sparse-clone very large repos unless needed.
Inspection Order
- README and license.
- Manifests:
package.json,pyproject.toml,Cargo.toml,go.mod. - Install scripts, Dockerfiles, GitHub Actions.
- Tool/MCP configs and permissions.
- Source entry points.
Red Flags
- raw executable zip/binary download as primary install
- curl-piped shell
- postinstall scripts that fetch remote code
- account/session control without a narrow use case
- broad filesystem or shell tools exposed through MCP
- unclear license
Output
# Source Intake Report
Repo:
Local path:
Disk size:
License:
Runtime:
Install risk:
Useful patterns:
Do not run:
Next action:
Then use $repo-intelligence-brief for safe repos.
Validation
- Clone depth, disk size, license, runtime, and install risk are recorded.
- No untrusted install scripts, binaries, package installs, or servers were run.
- Risky repos are marked inspiration-only until reviewed.