# GitHub Repository Safety Checklist

Use this before downloading an app, opening an executable, or pasting an install command from GitHub.

## 1. Check the repository history

- Open **Commits**.
- Is the project older than a few days?
- Does the history show gradual development instead of one giant upload?
- Are multiple recognizable contributors involved?

## 2. Check the creator

- How old is the account?
- Does it have other legitimate repositories?
- Does the person have followers and a believable contribution history?
- Is there a real identity or organization connected to the work?

## 3. Look for real community activity

- Are there specific issues and useful replies?
- Are pull requests being reviewed?
- Do discussions sound like real people using the tool?
- Does that activity make sense next to the star count?

A high star count is a popularity signal, not a security review. Stars can be manipulated or bought.

## 4. Review what the install process does

Look carefully for:

- `curl` or `wget`
- PowerShell or `Invoke-WebRequest`
- A script that downloads another file
- A downloaded file that runs automatically
- Obscured commands or code
- Requests to disable antivirus or security settings

## 5. Be extra careful with executable files and terminal commands

- Do not run an `.exe` just because it is listed under Releases.
- Avoid administrator access unless there is a clear reason.
- Verify the publisher, checksum, or signature when one is provided.
- Scan downloaded files with your security software.
- Do not paste a terminal command until you understand what it downloads and runs.

## Prompt for Claude or ChatGPT

Review this GitHub repository before I download or run anything: [PASTE LINK]

Please check:
1. The age and commit history of the repository.
2. The creator's account history and other repositories.
3. Whether the stars match real issues, pull requests, contributors, and discussions.
4. Every install command and script for code that downloads or runs another file.
5. Any .exe, PowerShell, curl, wget, or administrator commands.

Explain the warning signs in plain English. Tell me what you can verify, what you cannot verify, and what I should inspect before running it. Do not assume a high star count means it is safe.

## Important

An AI review is a useful second opinion, not a guarantee. Do not share private code, passwords, API keys, or other secrets. If the history, creator, community, and install process do not add up, do not run the project.

More practical playbooks: https://chadesheppard.com/playbooks