ClaudeRabbit
New scan
github.com/DouglasFreshHabian/OsintDroid · 5525c3b

80/ 100

Low riskPartial run

Low risk: The repository was reviewed, but no code ran in the sandbox. Scanned 27 Oct 2026.

Nothing to build: no package.json, go.mod, Cargo.toml, pyproject.toml, setup.py, requirements.txt or Makefile

Watch how it happenedScan another
NetworkNone
No network calls
CodeNothing taken off
no code deduction

Score

100 − 8 = 80
1000
Partial scan: Nothing …g the code: capped at 80. −8

Points taken off

−8
−8
Partial scan: Nothing to build: no package.json, go.mod, Cargo.toml, pyproject.toml, setup.py, requirements.txt or Makefile. Nothing ran in the sandbox, so the score rests on reading the code: capped at 80.

What it did

26 events in 16.2s
Fetched5.1s
4494 bytes fetched inside the VM from codeload.github.com in 1349 ms; commit id verified; egress restored
Read10.0s
0 scanner finding(s)
Checked10.0s
0 locked dependencies, 0 malicious
Jev11.1s
Answered questions from the evidence
Sandbox11.1s
install none, entry skipped, 0 forged call(s)
Score11.1s
80 Low risk

Luna's report

This is Low risk, but runtime behaviour was not observed. Pin the reviewed version before use. The entry phase was skipped, so its behaviour was not observed.

We scanned the repository’s reachable code, but it had no supported install step, so we could not install it or run its entry point in the throwaway sandbox. Sandbox behaviour was not observed.

What it ran

InstalledNothing to install
Entry pointNone found
NetworkNo calls
MachineDestroyed after the scan

Jev's answers

answered from the evidence
Docs check
The docs do not say it makes no network calls
The docs do not say it has no side effects
Show all 3 answers
What it did fits what its docs say it is for
Install check
Install-time code does not use the network
Install-time code does not read credentials
Show all 4 answers
Install-time code does not run other programs or payloads
Install-time code is not obfuscated

Not verified

Behaviour outside the observed install and entry windows

Code paths not triggered by install or the entry point

Show all 5 items

Payloads gated on calendar dates past the accelerated clock window, or on hosts that need real responses

Install: the repo has no install step the sandbox runs (no package.json, go.mod, Cargo.toml, pyproject.toml, setup.py, requirements.txt or Makefile), so its code was read, not run

Entry phase was skipped, so its behaviour was not observed

Reputation

GitHubOwner 3 years old
GitHubOwner established (over a year, 3+ public repositories)
GitHub208 stars
GitHub33 public repos

Shown apart from the code and behaviour findings.