Forensify — Cross-Agent Stack Self-Audit

Read-only audit of the skills, MCP servers, hooks, plugins, and credentials already installed across Claude Code, Codex, OpenClaw, and Cursor, with a structured risk briefing.

Security & ReviewAdvanced★ 191⑂ 28AI score 9/10Last updated: Sep 27, 2026

What it does

Auto-detects which agent ecosystems exist on the machine (Claude Code, Codex, OpenClaw, NanoClaw, Cursor).
Walks seven surfaces — skills, MCP servers, hooks, plugins, commands, memory files (CLAUDE.md / AGENTS.md), credentials — and emits a deterministic, zero-LLM JSON inventory with NFKC normalization and bidi-override rejection.
Runs six parallel domain analyses: skill injection and shadow overrides, MCP rug-pull/tool-poisoning, hook auto-execution, plugin trust chain, config & memory drift, credential permissions.
Renders a dual-format briefing.md + briefing.json, with grounding post-checks and suppression detection (a sub-agent that silently drops a CRITICAL finding is flagged).
Never reads credential values — only file mode, perms, auth_mode, token staleness. The only writable path is ~/.cache/forensify/runs/.

Who it's for

Anyone who has accumulated skills, plugins, and MCP servers over months and lost track of the attack surface.
Users running Claude Code alongside Codex or Cursor who hit config collisions or token overwrites (e.g. openai/codex#54506).
Developers and security reviewers doing a periodic posture check after installing new tooling.

Examples

forensify — auto-detect every installed ecosystem and produce a full audit briefing.
forensify --inventory — deterministic JSON inventory only, ideal for piping into CI or diffing over time.
forensify --target ~/.codex --domains credentials — focus on Codex auth.json permissions and token staleness.
forensify --include-shadows — extend the scan to backups, caches, and session databases to surface stale credentials or orphaned skill versions.

· · · Install guide · · ·

Try it now, no install

Paste this into Claude to use the skill without installing anything.

Read the instructions in this file and follow them to help me:
https://raw.githubusercontent.com/alexgreensh/repo-forensics/HEAD/skills/forensify/SKILL.md

What I want: (describe your task here)

If Claude can't open the link, open it yourself and paste the contents instead.

↓ If it works for you, download the ZIP below and install it. Then it runs on its own — no pasting each time.

Install in the Claude app (no terminal)

Download the ZIP with the button below.
In Claude, open Settings → Capabilities and turn on 'Code execution and file creation'. (one time)
Go to Customize → Skills → + → 'Upload a skill' and upload the ZIP.

↓ Download ZIP

Install in Claude Code

Let Claude do it — paste this into Claude Code

Install the skill I found on Claude Skill Mart.
Copy the skills/forensify folder from the GitHub repo alexgreensh/repo-forensics into my ~/.claude/skills/alexgreensh-forensify/.
When it's done, tell me in one line what this skill can do.

Install with a command instead

git clone https://github.com/alexgreensh/repo-forensics.git /tmp/repo-forensics && mkdir -p ~/.claude/skills && cp -r /tmp/repo-forensics/skills/forensify ~/.claude/skills/

⚠ This is a third-party skill. Check the source repository before installing.

Open a terminal.
Clone the repository: git clone https://github.com/alexgreensh/repo-forensics.git
Create the skills folder if needed: mkdir -p ~/.claude/skills
Copy the skill in: cp -r repo-forensics/skills/forensify ~/.claude/skills/
Verify Python 3 is available: python3 --version (no pip packages are required).
Restart Claude Code and confirm forensify appears in your skill list.
Start light with forensify --inventory, then run the full audit with forensify.
Read the report at ~/.cache/forensify/runs/<run>/briefing.md; nothing outside that folder is written.

View source on GitHub ↗License: NOASSERTION