BlastRadius – A pre‑flight safety scan for AI coding agents

Hey PH community 👋

I've been using AI coding agents (Claude Code, Cursor, Codex, aider…) to work with open‑source repos, and I noticed a scary gap:

You git clone a project, you point an agent at it, and before you type a single command, code can already run.

A .git/hooks/pre‑commit, an npm postinstall, a .envrc, a VS Code task set to folderOpen, a CLAUDE.md that tells the agent to curl … | bash – none of these show up in a normal diff review.

Your agent will happily trigger them for you, because it's just following instructions.

Existing tools focus on runtime approval ("allow this command?"). But nobody answers the real question:

"What in this repo can execute without my explicit approval – before I even approve anything?"

So I built BlastRadius – a static scanner that finds every auto‑execution point in a repository. It shows you the actual code, explains what triggers it, and ranks each risk by blast radius – from Medium to Critical – so you know exactly how bad it gets if it fires.

It covers 39 detectors across Git hooks, Node lifecycle scripts, Python hooks, editor tasks, agent configs, shell rc files, and more. The risk engine doesn't just flag everything – it amplifies severity based on what the code actually does (pipe‑to‑shell, credential theft, persistence, exfiltration…). A harmless "postinstall": "echo thanks" stays Medium, while curl … | bash becomes Critical.

You can run it as a CI gate, baseline known findings, output SARIF (directly upload to GitHub Code Scanning), JSON, Markdown, or HTML. Zero dependencies – just pip install blastradius-scan and you're ready.

I think this is a problem many of us face, especially now that "clone and let the agent figure it out" is becoming the default workflow. I'd love to hear your thoughts:

• Have you ever had a close call with an auto‑execution hook?

• What other vectors should we look for?

• How does your team handle these risks today?

The project is open‑source (Apache‑2.0) on GitHub. Try it out, file issues, or just join the conversation – I'd really appreciate your feedback.

Thanks for reading 🙏