whereismyai
Autorun Audit
Autorun Audit is a command-line tool that finds hidden code execution risks in repository configurations and Python environments.
Autorun-audit lists everything that executes automatically when you open a repository, enter its directory, install it, start an agent, or start Python. It scans repository files like VS Code tasks, agent hooks, MCP server definitions, dev containers, and Python startup files such as .pth and sitecustomize.py. The tool runs safely by making a hardened temporary clone or inspecting Python environments without executing untrusted startup code. It reports capabilities such as shell command execution, network usage, file modification, and credential reading. Outputs are available in text, JSON, and SARIF formats for use in terminals or continuous integration.
Autorun Audit at a glance
Key features
- Scans repository configuration files and Python startup files
- Performs shallow, hardened temporary repository clones
- Inspects Python environments without executing startup code
- Identifies capabilities like network usage and credential reading
- Outputs reports in text, JSON, and SARIF formats
- Supports allowlists to filter reviewed findings
Use it for
- Audit repositories before cloning or opening them in editors
- Scan Python environments for unauthorized startup files
- Run automated checks in continuous integration pipelines
Alternatives to Autorun Audit
- jevgrep — Reduces coding agent costs by providing targeted, relevant repository context.
- AutoCVE — Automates the entire CVE discovery workflow from source code audit to report generation.
- Git AutoReview — Parallel AI reviews with human approval and bring-your-own-key security.
- Autoloom — It embeds engineering judgment, change necessity checks, and evidence-backed delivery into automated coding.
- Autoprompt Skill — Reduces coding failures by 45 percent through automated verification loops.
- Manifestack — Audits your entire tech stack and flags limits or vendor overlaps.
- Stroq — Scans recorded sessions and guards future actions with local hooks.
- CodeScan Artex — It uses multiple parallel AI agents to read source code and verify vulnerabilities.
- Ranwhat — Audits coding agent actions and scans for secrets on your machine without telemetry.
- Claude Scrub — Removes exposed API keys, passwords, and tokens from local AI session history.
- DeepAudit — Multi-agent architecture and sandbox PoC verification reduce false positives.
- ARG architect — Get a weighted score across eight categories with specific failing checks.
All Autorun Audit alternatives