// see it
It traces the whole chain and points at the exact line
// static AI-agent security for CI/CD
You wired an AI agent into GitHub Actions to triage issues and review PRs. It runs on text anyone can write, and it holds real secrets. agentpipe finds that chain before an attacker does.
$pip install agentpipe-scan
// the problem
A workflow triggers on an issue or a pull request. It drops the issue title straight into the agent's prompt. The job holds an npm token and publish rights. Now anyone who opens an issue is handing instructions to a process that can publish your package or leak your keys. No one clicked anything. We call this class clinejection, and it is landing in real repos.
// see it
// use it
Install and run. It prints the findings. Nothing to install on a server.
pip install agentpipe-scan
agentpipe scan . # scan this repo's workflows
agentpipe local # audit AI-agent configs on this machineOn every pull request a bot posts one comment with the chains it found, and uploads results to your Security tab.
# .github/workflows/agentpipe.yml
name: agentpipe
on: [pull_request]
permissions: { contents: read, pull-requests: write, security-events: write }
jobs:
agentpipe:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: cyberbobas/agentpipe@v0
with: { fail-on: high, comment: true }No workflow files, no server. Install once on your GitHub organization. It watches every repo, comments on pull requests, and gives you a dashboard.
// pricing
agentpipe is free while in beta. The CLI and the Action are unlimited and open source, forever. The hosted App is free during beta with fair-use limits, so it stays fast for everyone.
// why agentpipe
Linters and code scanners check workflow config or source. agentpipe follows the link that actually hurts: untrusted event, to agent step, to a secret.
Guardrails inspect the prompt going into the model. agentpipe watches the action the model's step takes in CI. A prompt with no sensitive data passes a guardrail, then the agent reads a token and publishes. We catch that.
Every finding says what it proves, what it does not, and the one change that fixes it. agentpipe prove confirms it with a harmless canary, never an exploit.
// honest limits
agentpipe reports preconditions, not proof of exploitation. It analyzes GitHub Actions and local agent configs, statically. It does not run your agent and does not stop prompt injection. Each report ends with what the scan cannot see, which is where a real pentest begins.
// faq