I'm building ClonePeek, an open-source Python CLI and GitHub Action that inventories the execution hooks a repository can define: npm lifecycle scripts, VS Code folder-open tasks, devcontainer commands, Cursor/Claude Code hooks, and local MCP server launch commands.

A regression test surprised me: our "read-only" Git changed-files check could invoke a locally configured fsmonitor helper. We now constrain the Git subprocess as well as passively reading project config. That bug changed how I think about scanning untrusted checkouts.