Static · read-only · browser direct

Scan agent instruction files before your coding agent reads them.

Find AGENTS.md, CLAUDE.md, Cursor, Copilot, Gemini, and Windsurf rules across a public repository. Review hidden Unicode, remote execution, secret handling, destructive commands, and safety bypasses without running any repository code.

risk signals

file cap

commands run

Deterministic early-warning checks can miss malicious intent and can flag legitimate maintenance commands. Every match requires human review.

Free GitHub Action

Review every instruction change in CI.

Add the same eight deterministic checks to pull requests. The zero-dependency action adds line annotations, a job summary, and a JSON plus SARIF report without a token, network call, or telemetry.

View source

.github/workflows/agent-instruction-security.ymlfail on high

name: Agent instruction security

on:
  pull_request:

permissions:
  contents: read

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: sunxiayi/repo-agent-instruction-security-scan@v1

Free local CLI

Scan before your coding agent opens the repository.

Run the reviewed v1.1.2 release directly from GitHub. It needs no account, token, global install, or dependency installation, and it executes none of the instruction content it reads.

Download .tgz View v1.1.2

Text

Readable line findings

JSON

Machine-readable evidence

SARIF

Code-scanning compatible

Terminal · Node.js 20+fail on high

npx --yes github:sunxiayi/repo-agent-instruction-security-scan#v1.1.2 .

SARIF for code scanning

npx --yes github:sunxiayi/repo-agent-instruction-security-scan#v1.1.2 . --fail-on medium --format sarif --output agent-instructions.sarif

Validated pre-commit hook

repos:
  - repo: https://github.com/sunxiayi/repo-agent-instruction-security-scan
    rev: v1.1.2
    hooks:
      - id: repo-agent-instruction-security-scan

CI validates the manifest and installs this immutable release in an isolated Node environment. Pin the full reviewed commit when your policy requires a commit-SHA boundary.

Versioned package · 11.0 KB

Verify before installing:

SHA-256 e99ad514e8c03aa82eb5bdf6213eb8cf1d75c1426e0ccd377e1643e7d236ea9c

Threat boundary

Instruction files are privileged context, not ordinary docs.

Coding agents can execute commands, read files, and call external services. Instructions embedded in repository content can influence those actions, so static review should happen before trust—not after execution.

Read the secure deployment guidance

Review what humans miss

Render invisible and bidirectional controls as explicit code points.

Keep secrets bounded

Flag instructions that pair sensitive material with outbound transfer or broad access.

Preserve approval

Surface commands and language that weaken sandbox, confirmation, or review boundaries.

What the result means

A match is a focused review prompt, not proof of malicious intent. Install scripts, maintenance commands, and credential guidance can be legitimate when they are narrow and independently reviewed.

A clean result is not a security guarantee. Static patterns cannot establish provenance, detect every indirect instruction, or prove that runtime permissions and network controls are safe.