agentpipe

Find CI agents that eat untrusted GitHub events and hold keys. A repo lets a stranger's issue title drive an AI agent step that carries an npm token, and now an issue is a publish. agentpipe finds those chains statically, before anyone opens the issue.

Not an Actions linter. Not gitleaks. It reports preconditions and never exploits.

Part of Agentoffense. The recon front of the line: find the exposure here, close it at runtime with Airlock and Countersign.

pip install agentpipe-scan
agentpipe scan .                          # local clone, no network
agentpipe scan github.com/org/repo        # public workflows via GitHub API
agentpipe scan github.com/org             # whole org, aggregated report
agentpipe prove .                         # canary kit: prove each finding harmlessly
                                          # (token: GITHUB_TOKEN env or --token)

The killer bit: prove

A finding says "preconditions exist". agentpipe prove turns each high/medium finding into a harmless canary kit: a unique token, the exact issue/PR text to paste into a fork you own, the three places to watch (comment, step summary, job log), what a positive result proves — and what it still doesn't (that part is the pentest). Every payload is echo/read-only by construction.

The report also groups flat findings into attack chains (entry → amplify → impact, one per job, severity-tagged).

agentpipe local — the laptop half

CI is only half the surface. agentpipe local audits agent configs on the machine itself (~/.claude.json, .mcp.json, cursor/gemini/windsurf configs):

Read-only, no network, secret values never printed.

Clinejection-class demo (issue title → Claude in Actions → npm token):

agentpipe scan examples/clinejection-repo

What the scanner flags

Findings carry real file:line of the agent step. A workflow that does not parse is a loud warning, not a silent skip.

Not yet: INS-01..04 (instruction-file hygiene in repos), GitHub Action wrapper, --follow-remote.

What you will not see

A 0–100 score. A badge. Telemetry. A working exploit. An Airlock pitch.

The report ends with what this scan cannot see — that list is the pentest offer.

Verdicts

reachable (trigger + agent + sink) · plausible (untrusted field in the prompt) · adjacent (one piece of the chain). Severity only on the first two.

MIT. Python ≥ 3.11. PyYAML.

python3 tests/run.py           # regression suite (41 checks)
python3 tests/adversarial.py   # parser fuzz, FP/FN matrix, recursion, ReDoS, CLI
python3 tests/matrix.py         # negative matrix per detector, GitHub semantics, live corpus