Airlock

Check a stranger's GitHub repository before you run it. A fenced AI agent reads it first and tells you if it is safe.

Someone sends you a take-home task. A free trading bot promises easy returns. A starter kit asks you to run npm install. Any of them can run code on your computer the moment you install or open it, and read your SSH keys, browser data or crypto wallets. Airlock checks the repository first, without it ever touching your computer. How it works: 1. On a GitHub repository or an npm package page, press "Check before you run". 2. Airlock copies the repository onto its own server. An AI agent reads it inside a fence set by ArmorIQ policy: it can read the code, but running commands is blocked and fetching a web page waits for your approval. 3. You get a plain answer (Looks safe, Be careful, or Don't run it) with the reasons, the exact files and lines, and a report link you can share. What Airlock looks for: - Scripts that run on install, or when you open the folder in your editor - Code that reads SSH keys, .env files, browser profiles or cloud credentials - Crypto wallet access and clipboard address swapping - Data sent to Telegram bots, Discord webhooks, paste sites or bare IP addresses - Packed or encoded code, and programs shipped inside the repository - Text planted to steer AI coding assistants Private by design: the extension sends only the address of a repository you choose to check. No account, no cookies, no tracking. Nothing is sent until you press the button. You can turn on "Show earlier verdicts" in Settings to see a previous result as soon as you open a repository page. Free to use.