Observed arrival · 2026-09-18
RepoSafety — Don’t install the take-home yet
A Cursor command that reads an interview repository before installation and reports whether it should be installed.
- For
- Developers reviewing interview take-home repositories
- Worth noticing
- The example reports a hidden server call and npm token while inspecting files without installing the project.
Field notes
The command operates before installation and limits its inspection to repository files, avoiding npm install, tests, application startup, and Docker execution of the take-home itself. Its checks extend beyond JavaScript manifests to lock files, Python, Rust, Go, Git hooks, editor tasks, CI configuration, and git history. The example treats an assignment-mismatched package as a reason to investigate rather than automatic proof of malware, while concealing the value of a detected npm token.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
One card from the complete issue