DEV Community

Cover image for I Built an Antivirus for AI Artifacts: Here's How to Use It in Your CI/CD Pipeline
aegisgate
aegisgate

Posted on

I Built an Antivirus for AI Artifacts: Here's How to Use It in Your CI/CD Pipeline

#opensource #ai #security #devops

AI systems consume artifacts the same way software systems consume dependencies. RAG documents, training datasets, model configurations, and agent skills are all inputs that shape what your AI does. A single poisoned document can inject malicious prompts, exfiltrate secrets, or cause model misbehavior.

I'm the solo founder of AegisGate Security, and I just released AegisGate Scanner v0.3.0 — a static analysis tool that scans AI artifacts for security threats before they reach production.

268 detection patterns. 9 categories. 8 output formats. Apache 2.0. No telemetry.

Here's what it does and how to use it.

Why I Built This

I looked at the existing tooling landscape and found a gap:

Threat Semgrep / CodeQL TruffleHog / Gitleaks AegisGate Scanner
Prompt injection ❌ ❌ ✅ 17 patterns + ML
Secrets Partial ✅ ✅ 64 patterns
PII (US + International) ❌ ❌ ✅ 85 patterns
Dangerous code (agent skills) Partial ❌ ✅ 34 patterns
Compliance (HIPAA/GDPR/EU AI Act) ❌ ❌ ✅ 47 patterns
OT/ICS protocol exposure ❌ ❌ ✅ 9 patterns
Archive extraction ❌ ❌ ✅ zip/tar.gz/tar.bz2
SARIF output ✅ ❌ ✅
ML-based detection ❌ ❌ ✅
SBOM generation ❌ ❌ ✅ SPDX

Semgrep and CodeQL are excellent for code-level dataflow analysis. TruffleHog and Gitleaks are great at finding secrets. But none of them scan for prompt injection embedded in a RAG corpus, or dangerous function calls hidden in an agent skill file, or PII leaking through a training dataset.

Scanner isn't a replacement for those tools — it's a complementary tool purpose-built for the AI artifact attack surface.

Quick Start: 30 Seconds to Your First Scan 

# Install (curl — one-line installer with checksum verification)
curl -fsSL https://raw.githubusercontent.com/aegisgatesecurity/aegisgate-scanner/main/install.sh | bash

# Or via Homebrew
brew install aegisgatesecurity/tap/aegisgate-scanner

# Or from source
go install github.com/aegisgatesecurity/aegisgate-scanner/cmd/aegisgate-scanner@latest

# Scan a directory
aegisgate-scanner scan ./my-project

# Self-test (verify installation, scan own codebase)
aegisgate-scanner doctor
Enter fullscreen mode Exit fullscreen mode

That's it. No config file required. No API keys. No telemetry. It just scans.

What It Detects

268 regex patterns across 9 categories, plus an optional neural detection layer:

Category Patterns Examples
Prompt Injection 17 "Ignore all previous instructions", SSTI probes, base64-encoded payloads, indirect injection
Secrets 64 AWS keys, GitHub tokens, OpenAI keys, Stripe keys, Slack tokens, JWT, private keys
PII — US Core 32 SSN, email, phone, passport, driver's license, ITIN
PII — US Extended 13 Employer ID, VIN, bank routing, Medicare, NAIC
PII — Financial 16 Credit cards (Visa/MC/Amex/Discover), IBAN, SWIFT/BIC
PII — International 24 UK NHS, Canada SIN, Germany Steuer, France INSEE, Australia TFN
XSS 12 Script injection, event handlers, encoded payloads, SVG vectors
Compliance 47 OWASP LLM Top 10, EU AI Act, MITRE ATLAS, HIPAA, GDPR, COPPA, CCPA
Dangerous Functions 34 eval(), exec(), os.system(), subprocess, pickle.load(), child_process.exec()
OT/ICS Protocols 9 Modbus, S7comm, DNP3, BACnet, EtherCAT, OPC UA, Profinet
ML (optional) 1 model Neural detector for adversarial prompt injection variants

The ML layer is optional and additive. The scanner ships in two builds: a lite build (pure Go, no CGO, ~20MB Docker image) and an ML build (with ONNX Runtime, ~150MB). Both share the same 268 regex patterns.

CI/CD Integration: GitHub Action

This is where Scanner shines. Add it to any workflow and get SARIF results in GitHub's code scanning UI:

name: AegisGate Scanner
on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aegisgatesecurity/aegisgate-scanner@v0
        with:
          path: '.'
          format: 'sarif'
          severity: 'medium'
      - uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: aegisgate-report.sarif
Enter fullscreen mode Exit fullscreen mode

The Action is live on the GitHub Marketplace. Use @v0 for auto-updating to the latest major version, or pin @v0.3.0 for reproducibility.

Available inputs:

Input Default Description
path . Directory to scan
format github Output format
severity medium Minimum severity threshold
no-ml false Disable ML detection
diff false Show only new findings
baseline — Baseline file path for diff
disable-rule — Rules to disable (comma-separated)
concurrency 0 Parallel workers
no-extract-archives false Disable archive extraction

Docker: Two Images for Different Use Cases 

# ML-enabled (full detection, ~150MB)
docker build --target ml -t aegisgate-scanner .
docker run --rm -v $(pwd):/github/workspace aegisgate-scanner scan /github/workspace

# Lite (heuristic-only, ~20MB, distroless — no shell, no package manager)
docker build --target lite -t aegisgate-scanner:lite .
docker run --rm -v $(pwd):/github/workspace aegisgate-scanner:lite scan /github/workspace
Enter fullscreen mode Exit fullscreen mode

The lite image is distroless — no shell, no package manager, minimal attack surface. Perfect for CI pipelines where you want the smallest possible image and don't need ML detection.

8 Output Formats

Scanner supports 8 output formats out of the box. Here's when to use each:

# Text — terminal / human-readable (default)
aegisgate-scanner scan ./project

# JSON — programmatic / API integration
aegisgate-scanner scan ./project --format json -o results.json

# JSONL — NDJSON for Splunk, ELK, Datadog
aegisgate-scanner scan ./project --format jsonl -o findings.jsonl

# SARIF — GitHub Code Scanning / CI/CD
aegisgate-scanner scan ./project --format sarif -o results.sarif

# HTML — reports / email / sharing
aegisgate-scanner scan ./project --format html -o report.html

# PR Comment — pull request comment (markdown table)
aegisgate-scanner scan ./project --format pr-comment

# GitHub Actions — PR annotations in CI
aegisgate-scanner scan ./project --format github-actions

# SBOM — SPDX software bill of materials
aegisgate-scanner scan ./project --format sbom -o sbom.spdx.json
Enter fullscreen mode Exit fullscreen mode

Advanced Features Worth Knowing About

Archive Extraction with Bomb Protection

Scanner extracts and scans inside .zip, .tar.gz, and .tar.bz2 archives:

aegisgate-scanner scan ./project --extract-archives
Enter fullscreen mode Exit fullscreen mode

Archive bomb protection enforces a 100MB extraction limit and 10,000 file count limit. Path traversal (Zip Slip / Tar Slip) is blocked. This is important — an attacker could hide a poisoned document inside a seemingly innocuous archive in your RAG corpus.

Baseline Suppression for CI/CD Gating

Don't let pre-existing findings block your pipeline. Create a baseline, then scan for only new findings:

# First run — create baseline
aegisgate-scanner scan ./project --format json -o baseline.json

# Subsequent runs — only new findings
aegisgate-scanner scan ./project --diff --baseline baseline.json
Enter fullscreen mode Exit fullscreen mode

This is the pattern I recommend for CI/CD gating: scan on every PR, but only fail the build on new findings. Pre-existing issues can be tracked and remediated separately.

Content-Hash Caching

Skip re-scanning unchanged files across runs:

aegisgate-scanner scan --cache .
Enter fullscreen mode Exit fullscreen mode

Results are cached by SHA-256(content) — renamed files still hit the cache. Only content changes, pattern changes, or scanner version bumps invalidate the cache. In a monorepo with thousands of files, this makes incremental scans near-instant.

Git History Scanning

See when findings were introduced:

aegisgate-scanner scan-history ./project
Enter fullscreen mode Exit fullscreen mode

Scans commit-by-commit, showing when a secret or prompt injection was first added and by whom. Useful for incident response and audit trails.

Stdin/Pipe Mode

Scan piped content without writing to a file:

cat suspicious_agent_skill.py | aegisgate-scanner scan - --stdin-ext .py
curl -s https://example.com/rag-doc.md | aegisgate-scanner scan - --stdin-ext .md
Enter fullscreen mode Exit fullscreen mode

Custom Patterns

Add your own detection patterns via .aegisgate.yml:

custom_patterns:
  - name: "custom_api_key"
    regex: "MY_KEY_[a-zA-Z0-9]{32}"
    severity: "high"
    description: "Custom API key format"
Enter fullscreen mode Exit fullscreen mode

Disable Specific Rules 

aegisgate-scanner scan ./project --disable-rule secret_aws_key --disable-rule pii_ssn
Enter fullscreen mode Exit fullscreen mode

Performance

The v0.3.0 release included a performance sprint. Here are the numbers:

Input Size Latency Throughput
1 KB 18.7 ms ~53 KB/s
100 KB 0.19 s ~526 KB/s
1 MB 1.88 s ~532 KB/s
10 MB 18.8 s ~532 KB/s

That's a 12x improvement over v0.2.0 (was 12.7s/MB, now 1.88s/MB), achieved through line-by-line keyword pre-filtering and binary-search line/column lookup. Latency scales linearly with input size.

The 1 KB case (~19ms) is fast enough for real-time IDE integration. A self-scan of the scanner's own codebase (61 Go files) completes in 5.8 seconds with 14 MB peak memory.

Testing

I take testing seriously. The scanner has:

Test Type Count Description
Unit tests 1,080+ Per-function correctness
Benchmark tests 8 Performance regression detection
Fuzz tests 6 Random input crash detection
Race tests 7 Concurrent access validation
Archive security tests 12 Bomb/traversal/symlink protection
Evasion suite 1 50 transforms × 52 adversarial payloads
E2E tests 10 Full pipeline integration

All 9 testable packages maintain ≥90% coverage. The race detector runs in CI. Fuzz testing runs in CI.

Configuration

Create .aegisgate.yml in your project root:

# Paths to ignore (glob patterns)
ignore_paths:
  - "node_modules"
  - "vendor"
  - "dist"
  - "*.test"

# File extensions to scan (empty = all supported)
extensions: []

# Severity threshold (critical, high, medium, low)
severity: "medium"

# Enable ML detection (requires CGO build)
ml: false

# Parallel workers
concurrency: 0

# Extract archives before scanning
extract_archives: false

# Custom patterns
custom_patterns:
  - name: "custom_api_key"
    regex: "MY_KEY_[a-zA-Z0-9]{32}"
    severity: "high"
    description: "Custom API key format"
Enter fullscreen mode Exit fullscreen mode

Exit Codes

Code Meaning
0 No findings (clean)
1 Findings detected
2 Scanner error (invalid path, config error, etc.)

This makes it trivial to gate CI pipelines:

aegisgate-scanner scan ./project --format sarif -o results.sarif && echo "Clean" || exit $?
Enter fullscreen mode Exit fullscreen mode

Where It Fits in the AegisGate Ecosystem

Scanner is one of four AegisGate products, each addressing a different layer of the AI security stack:

  • AegisGate Platform — Server-side gateway. Intercepts live API calls, 223 detection patterns, 30+ compliance frameworks. For teams running AI in production.
  • AegisGate Rampart — Free local proxy. Intercepts secrets before they leave your machine when using AI coding tools. For individual developers.
  • AegisGate MCP — Secure MCP server framework with 23 security layers. For teams building MCP servers.
  • AegisGate Scanner — Static analysis for AI artifacts. Runs in CI/CD or locally. Scans files before they reach your AI system.

Scanner is the shift-left complement to our runtime products. Scan files before they enter your AI pipeline, not after.

What's Next

v0.3.0 is the first public release. On the roadmap:

  • Scanner-specific corpus evaluation with dedicated test corpora
  • Competitive benchmark report against TruffleHog, Gitleaks, and Semgrep
  • Transformer-based ML model upgrade (DistilBERT/BERT)
  • Multimodal artifact support (image-based prompt injection)
  • Streaming scan mode for very large files
  • Additional archive formats (.7z, .rar)

Try It 

curl -fsSL https://raw.githubusercontent.com/aegisgatesecurity/aegisgate-scanner/main/install.sh | bash
aegisgate-scanner scan ./my-project
Enter fullscreen mode Exit fullscreen mode

If this is useful, star the repo. It helps others discover it.

Secure Every AI Interaction.

Josh Colvin is the founder of AegisGate Security, building open-source, self-hosted AI security. Apache 2.0. No telemetry. No data egress.

Top comments (0)