Every few days there's a new MCP server or Claude Code skill worth trying. And almost all of them you install the same way: copy a command out of a README, paste it into your terminal, done.
I did this maybe twenty times before it occurred to me that I was running code from strangers, on the machine where I keep my SSH keys and cloud credentials, without reading a single line of it first.
So I built a small tool to check them before they run. It's called frisk.
What it actually looks for
frisk is a static scanner. It never runs the code it's looking at — it reads the files and matches patterns, so it's safe to point at something you don't trust yet. It's plain Python, stdlib only, no dependencies. For a tool whose entire job is "is this safe to install," I wanted something you could read top to bottom in one sitting.
