agentpipe
An AI agent in your GitHub Actions reads a stranger’s issue title, a PR body, a fork’s branch name — and that same job holds an npm token and a publish step. agentpipe is the static scanner that finds those pipelines before an attacker does. It reads your workflows and your local agent configs, maps the attack chain from untrusted input to secret, and points at the exact file:line. No network, no runtime, no exploitation.
pip install agentpipe-scanRuns locally, reads only — no network access, no code execution, no exploitation. Scan a repo, a whole GitHub org, or your own machine. Python ≥ 3.11. Free & open-source under MIT. One command: agentpipe scan . Or drop the GitHub Action into your pipeline for a sticky PR comment and SARIF.
// the problem
A stranger’s issue title shouldn’t be able to drive a job that holds your npm token
Teams wire AI agents into CI to triage issues, review PRs and answer discussions. Those jobs run on events anyone can create — and they carry the tokens CI always carries. That is a “clinejection”: attacker text on one end, a publish step on the other. Where it goes wrong:
Untrusted event as input
An issue title, a PR body, a comment, a fork’s branch name — text anyone on the internet can write — reaches an AI agent step as if it were a trusted instruction.
The job carries secrets
The same workflow holds GITHUB_TOKEN, an NPM_TOKEN, cloud keys or a deploy credential — and a pull_request_target trigger runs it with write access on a fork’s content.
An issue becomes a publish
The agent, following the injected text, runs the step that publishes, comments, pushes or leaks. One opened issue turns into a release, a secret in a log, or a commit you didn’t write.
Dangerous agent settings
On the machine, ~/.claude.json and .mcp.json quietly disable confirmations, allow unpinned package installs and keep credentials in plaintext.
Nobody scans for this
Secret scanners look for leaked keys, SAST looks at app code. Neither reads a workflow and asks “can untrusted input reach a step that holds a secret?”
// this already happened
A compromised, widely-used GitHub Action was made to dump CI secrets into public build logs across thousands of repositories (CVE-2025-30066).
An untrusted GitHub event drives an AI agent step that carries an npm token — and now an opened issue is a publish. The class agentpipe is built to find.
Prompt injection hijacks an agent into running attacker-chosen steps — in CI, those steps run with the pipeline’s full privileges.
// how it works
It reads the pipeline the way an attacker would — and names the reachable path
agentpipe statically parses your workflows and agent configs. It finds every place untrusted input enters, follows it to the steps that hold power, and reports only the chains that actually connect — entry point, amplification, impact — with the exact file:line. Nothing is executed, nothing leaves your machine.
Attack-chain, not a keyword hit
Reports the chain that connects — untrusted entry → amplification (a token, a privileged trigger) → impact (publish, push, leak). A dangerous setting with no reachable path is noise, and it says so.
Canary, not a maybe
agentpipe prove . plants a harmless canary token to confirm a finding is really reachable — a real signal instead of a theoretical one. Needs only a GITHUB_TOKEN.
Your machine too
agentpipe local reads ~/.claude.json and .mcp.json, flags disabled confirmations, unpinned installs and plaintext secrets — and masks the secrets in its own output.
// local audit
The riskiest config is often the one on your own laptop
agentpipe local audits the machine-level agent configuration the same way it audits a pipeline: it reads ~/.claude.json and .mcp.json, flags confirmations turned off, packages installed unpinned and credentials sitting in plaintext — and masks every secret in its own report. No network, read-only.
// usage
One command in CI or on your laptop
Drop agentpipe scan . into a CI step and it fails the build on a reachable chain — the exposure gets caught in review, not in an incident.
// in your ci
One line in CI: a sticky PR comment, SARIF, and a baseline that stays quiet on old debt
agentpipe is not just a local scanner. Drop the GitHub Action into your pipeline and it reviews every PR, patches what it safely can, and enforces a policy your teams cannot quietly loosen.
GitHub Action + SARIF
One line in your workflow posts a single, updatable comment on the PR with the chains that PR introduces, and uploads SARIF straight to your Security tab (Code Scanning). Baseline mode stays silent on existing debt and speaks only for what a PR adds.
agentpipe fix
agentpipe fix writes safe, round-trip patches. Your comments and formatting survive, and anything intent-specific is left as advice, never an unsafe auto-edit. Dry-run by default.
Policy as code, repo and org
A repo carries a .github/agentpipe.yml policy, and a security team sets an org policy that a single repo cannot loosen with a quiet commit. That org enforcement is the foundation of the company layer.
// what it does — and does not — cover
We publish our own limits
| Surface | Covered | How |
|---|---|---|
| Untrusted GitHub events reaching agent steps | ✔ yes | Static entry-point analysis of workflow triggers & inputs |
| Reachable chain to a secret / publish | ✔ yes | Traces entry → amplification → impact, reports only connected paths |
| Dangerous local agent config | ✔ yes | agentpipe local on ~/.claude.json, .mcp.json |
| Runs in CI, PR comment + SARIF | ✔ yes | GitHub Action uploads to Code Scanning; baseline stays silent on old debt |
| Safe autofix for findings | ✔ yes | agentpipe fix, round-trip, dry-run by default |
| Org policy a repo cannot loosen | ✔ yes | .github/agentpipe.yml plus an enforced org policy |
| Proof a finding is real | ✔ yes | prove plants a harmless canary token |
| Exact location | ✔ yes | Every finding reports its file:line |
| Known limits — stated up front | ||
| Runtime enforcement | ✘ by design | agentpipe is a scanner — pair it with a runtime gate (airlock_ai) |
| Non-GitHub CI (GitLab, Jenkins…) | ◑ roadmap | GitHub Actions today |
| The injection text itself | ✘ by design | It finds the reachable path; it doesn’t scan language for intent |
// pairs with airlock_ai & countersign
Find it in review, gate it at runtime
agentpipe is the shift-left half: it finds the exposed pipeline before it ships. airlock_ai gates the agent’s calls at runtime against a policy, and countersign puts an honest human signature on the ones that reach a person. Scan in CI, enforce in production.
// pricing
Free for people. Talk to us for companies.
The scanner is free and open-source, forever, for individual users. Companies that need it across every repo in the org, wired into CI with an audit trail — get in touch, pricing is negotiable.
Open Source
- Scan a repo, a fork or a whole org
- Attack-chain mapping with
file:line - GitHub Action + SARIF + baseline mode
agentpipe fixsafe autopatchesprovecanary +localconfig audit- Per-repo policy file, runs locally, MIT
Company
- Org-wide continuous scanning with a dashboard & alerts
- Enforced org policy a repo cannot loosen
- GitHub Checks + SARIF across every repo
- Triage, prioritisation & remediation guidance
- Evidence pack for audit
- Onboarding, support & SLA
// built by AgentOffense
We break AI agents for a living. agentpipe is how we find the exposed pipeline first.
agentpipe comes out of our offensive work on agentic CI/CD — the clinejection chains it maps are the ones we exploit in engagements. Want an attacker’s view of your pipelines, or help wiring agentpipe across every repo in the org with an audit trail? That’s our day job.
Find the pipeline that eats untrusted input and holds a secret.
Static scanner for AI agents in CI/CD · GitHub Actions · runs locally · open-source (MIT).