AI use case

Check what your project and coding agent quietly installed overnight

After a rough month of poisoned packages, a developer built a tool that reads every package, agent skill, MCP server, and hook file in a project overnight without running any of them. A local model asks one question of each: does this do what it claims? You wake up to a list of anything suspicious.