How do I check a repo before I clone it?
Cloning by itself is close to harmless. Git copies files to your disk; it does not execute them. The risk arrives at the next step, when you install dependencies or run the thing, and that is where the checking belongs.
The gap between clone and install is the useful moment. You now have the code, and nothing has run. Read package.json for install hooks. Skim for code that decodes and evaluates, for reads of credential paths, for network calls to hosts that have nothing to do with the project. Check whether dependencies come from the registry or from somewhere that could be swapped.
You can also skip the clone entirely and have the reading done for you. xlogs downloads a public repo server-side and inspects it statically, so nothing touches your machine at all until you have decided.
If you do clone first, install with --ignore-scripts while you look. It blocks the automatic-execution path, and you can always install normally once you are satisfied.
Read a repo without cloning it
Common questions
Is git clone dangerous by itself?
Not on its own for ordinary use: it writes files, it does not run them. Be aware that hooks in .git/hooks can run on later git operations, and that opening a cloned project in an editor or agent may execute workspace configuration. The bigger risk remains install and run.
What does --ignore-scripts actually stop?
It prevents npm from running lifecycle scripts such as preinstall and postinstall, which is the path most commonly used to execute code the moment you install. Some legitimate packages need those scripts to build native code, so expect a few to need a normal install once you trust them.