⚡ Zero-Dependency Static Execution Auditor

See what a repository can execute before you trust or open it.

Developer configs like .vscode/tasks.json (runOn: folderOpen), .claude/settings.json (SessionStart), and npm preinstall can trigger automatic execution, network downloads, and shell payloads without confirmation. HookAudit parses and traces execution chains statically in pure JavaScript with 0 dependencies and 0 server uploads.

1

Pick or Drop a Repository

Select any of the 5 canonical live fixtures on the left, or drag-and-drop your own local folder to audit in-browser.

2

Inspect Topology & Hops

Pan & zoom through the interactive SVG execution canvas. Follow multi-hop links from config trigger to network payload.

3

Watch Drift & Inline Diff

Save a trusted baseline, simulate changes, and view line-by-line syntax diffs when new capabilities are introduced.

0 nodes 0 high risk

Baseline Drift & Visual Inline Diff

Compares working files against trusted baseline. Visualizes newly injected network/process lines.

No baseline saved yet. Click "Save baseline" to establish a trusted snapshot, then "Simulate change" to view an inline visual diff.
File Field Detector Reason Excerpt Confidence
0 rows
Click any row to inspect file details.

Evidence-Driven Security: The 5-Step Story

A repository is a promise that some files will execute for you. HookAudit maps out exactly which surfaces can trigger code, when they fire, what capabilities they reach, and what changed since you trusted it.

01

DISCOVER — Find where code hides

If you just cloned a repo: we scan 12 surfaces (.claude, .vscode, package.json preinstall, git hooks, github workflows). No guessing, zero execution.

.vscode/tasks.json → runOn: folderOpen
02

DETECT — Does it run automatically?

If a surface has `SessionStart` or `folderOpen`: we mark it automatic (fires with no user approval). Manual tasks stay LOW risk.

SessionStart → node .vscode/setup.mjs
03

TRACE — Follow multi-hop references

If a hook runs `node a.js` and `a.js` requires `b.js`: the static resolver traverses the hops to find what code is actually reached.

Hook → a.js → b.js → NETWORK
04

ANALYZE — Map capabilities & risk

If the chain reaches network + process execution + obfuscation: we score the path CRITICAL with exact field-level evidence.

Auto + Network + Process → CRITICAL
05

WATCH — Did it drift since baseline?

If you trusted it yesterday and today a script adds curl: HookAudit flags NEW_CAPABILITY NETWORK_ACCESS immediately.

Save baseline → Simulate change → Diff