sift

Scan AI agent instruction files for hidden or planted instructions.

Your repo now ships files that tell an assistant what to do: CLAUDE.md, .cursorrules, AGENTS.md, Copilot instructions, mcp.json. A human skims them in a diff; the model obeys every byte. That gap is where an attacker hides a command, pulled in through a cloned starter, a dependency, or a pull request. sift reads those files the way the model does and flags what a reviewer can't see: invisible characters, instructions buried in comments, "ignore previous instructions" payloads, data-exfiltration steps, and risky MCP configs.

Runs offline. No network calls, nothing leaves your machine.

Install

pip install siftscan

or, to keep it isolated:

pipx install siftscan

The command is sift.

Usage

sift                      scan the current directory
sift path/to/repo         scan a directory or a single file
sift --min high           only show high and critical findings
sift --json               machine-readable output
sift --quiet              no output, just the exit code (for hooks/CI)

Exit status is 0 when clean, 1 when there is a finding at or above the fail level (--fail-on, default high), and 2 on error, so it drops straight into a hook or a pipeline.

pre-commit

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/ReazGan/sift
    rev: v0.1.0
    hooks:
      - id: sift

GitHub Action

- uses: actions/checkout@v4
- uses: ReazGan/sift@v0.1.0
  with:
    fail-on: high

What it checks

Files scanned: CLAUDE.md, AGENTS.md, GEMINI.md, .cursorrules and .cursor/rules/*, .github/copilot-instructions.md, .windsurfrules, .clinerules, Qwen/Roo/Aider/IDX instruction files, and MCP configs (.mcp.json, .cursor/mcp.json, .vscode/mcp.json). node_modules, .git and build folders are skipped.

False positives

sift is tuned to stay quiet on real instruction files. The checks are narrow on purpose: ordinary advice like "never commit secrets" or "always run the tests" is not flagged, only wording that overrides, hides, or exfiltrates. If sift flags something you wrote on purpose, it is pointing at a line worth a second look, but you are the judge. Found a false positive? Open an issue with the line.

License

MIT