Coding agents are the new benchmark for dev teams: Claude Code, Cursor, Codex & Co. read your repo — and trust it. I asked myself: what happens when someone smuggles an instruction into the repo that the agent happily executes?
So I built AgentGuard — a CI gate for agent configurations (AGENTS.md, skills, MCP servers, hooks). And I stuffed my own repo with 12 targeted attacks. The honest protocol:
1. The attacks were easy to hide
12 payloads: a hidden instruction-override in AGENTS.md, invisible zero-width characters in a skill file, a typo-squatted MCP server host, a hook piping network content into a shell, a committed API key, an agent with wild Bash access… Every single one looks normal in a PR review.
AgentGuard detects all 12 — deterministically, no LLM in the scan path — with 47 unit tests that prove it forever (12/12 detected, 0 false positives on the clean control repo).
2. The real-world run: 30 repos, 5 with critical findings
I scanned 30 public repos via GitHub's code search for AGENTS.md — including Google, Microsoft and Nextcloud. 5 had critical findings. The most interesting: an invisible character right before a bash block in an agent spec. Coincidence or intention? That's exactly what the tool is for. Every finding was byte-verified manually and is public: real-world findings.
3. Double dogfooding
Two things happened that I could not have staged better:
(a) GitHub's own push protection blocked one of my pushes — a fake token in my own test file triggered GH013: Push cannot contain secrets. The biggest code host on the internet demonstrated on my repo exactly what AgentGuard catches on yours.
(b) Weeks later, after we shipped the v0.2.1 bypass protection, our own gate blocked our own pull request during the self-test — the new rule ignores any .agentguard-ignore shipped inside a PR, and our self-test workflow had relied on the old behavior. Red check. Merge refused. Working as designed. The full story is in the changelog.
Yesterday my own security tool blocked my own pull request. That is the best demo a security product can have.
4. What shipped in v0.2.1
-
Fail-closed gates: a typo in
exit-onno longer silently disables the gate — it fails loudly. -
PR bypass protection: a
.agentguard-ignoreshipped inside a PR is ignored; exclusions come only from the trusted workflow. - Hardened Pro server: HMAC length checks, 1 MB webhook body limit, per-repo installation resolution, safe tarball extraction (size limit, symlink/traversal rejection).
- New secret patterns: private keys, GitHub PATs, npm, Stripe, Slack webhooks. Details in SECURITY.md.
5. The bot blocked an attack, live
The GitHub App comments on every PR with a grade and findings, and sets a check-run gate. The proof is a real pull request: a planted attack got Note E, a red check, and no merge — see it live.
6. The landing page now shows the moment
The landing page has a live scan terminal in the hero: it types through files, finds the planted instruction, and ends on the green MERGE BLOCKED moment — the exact emotion this product sells: your agent reads your repo; your gate reads with it. Measured quality, not decoration: Lighthouse 100/100/100/100 on desktop and mobile, LCP 179 ms, CLS ~0, no horizontal scroll down to 320 px.
Try it
MIT-licensed, free for public repos on the GitHub Marketplace. Reply with your repo and get a free first scan — or open a request directly: audit/trial/redteam form.
🔗 Code: https://github.com/agentguard-dev/agentguard
🛒 Marketplace: https://github.com/marketplace/actions/agentguard-security
📊 Verified findings: https://github.com/agentguard-dev/agentguard/blob/main/docs/REAL-WORLD-FINDINGS.md
🔴 Live demo (attack blocked): https://github.com/agentguard-dev/agentguard-demo/pull/2
🌐 Landing page: https://agentguard-dev.github.io/agentguard/
Top comments (0)