BaitWatch

AI coding agents read everything in a repo, so a stranger can hide instructions for them in a README, a rules file or a skill. BaitWatch installs once as a Claude Code hook and then checks each repo automatically, with no scan to remember. It checks a repo in two ways: - READ: a fine-tuned Llama Prompt Guard 2 (86M) runs locally and reads every file, including decoded hidden payloads such as invisible text. Muse Spark then judges the flagged and suspicious chunks and explains its findings in plain English. - RUN: a decoy agent runs the repo in an offline Docker cage rigged with fake credentials and network traps, which catches attacks that only show up when the code runs. The results combine into an ALLOW, ASK or BLOCK verdict that stops the agent before it acts on the repo. If anything in the check fails, BaitWatch fails closed rather than letting the agent through.