owlwarden

For repositories you did not write

Check a repository before you open it in an agent

owlwarden vet checks agent config before you open the folder. It does not load the target's settings, baseline, plugins, or suppressions.

Install owlwarden Understand the surface

Check the config before opening the folder

  1. 01 CloneClone without opening the folder in an agent.
  2. 02 Run vetScan agent config with target policy disabled.
  3. 03 ReviewRead the finding and fix before opening the folder.
No network, no plugins, no target suppressions
git clone https://github.com/someone/thing ./candidate
npx owlwarden vet ./candidate

What makes it different from scan

scan reads your config, honours your baseline, and applies your inline suppressions. Those options are useful on a repository you maintain.

On an unfamiliar repository, its own policy can hide findings. vet therefore uses fixed settings:

SettingUnder vet
Presetagent-surface, the 10 rules that read configuration
NetworkNone. No OSV, no --target, no exceptions
PluginsNot loaded, even signed ones, even with a trust root configured
The target's configNot read
The target's baselineNot applied
Inline suppressionsCounted and reported, never honoured

Passing --plugin, --target, --baseline, or --allow-suppressions to vet is an error rather than a no-op.

Suppression count

The summary reports how many inline suppressions it found and confirms that none were applied.

Then what

vet tells you what is in the configuration. It does not sandbox execution. Open a suspicious repository in a sandboxed runtime. What the rules look for / the full catalogue / why none of this needs a network.

Keep reading