DEV Community

Dockfix Labs
Dockfix Labs

Posted on

Secure Your AI Agents in CI/CD: AgentGuard GitHub Action is Live

#ai #security #devops #github

Secure Your AI Agents in CI/CD: AgentGuard GitHub Action is Live

You can now scan your AI agent code for security vulnerabilities on every pull request. No configuration needed.

The Problem

AI agents have tools. Tools have access. Access means attack surface.

When you build an agent that can call os.system, read files, or make HTTP requests, you are creating a path from "user input" to "code execution". If an attacker can influence the agent's prompt, they can use that path.

This is not theoretical. It is how every prompt injection attack works.

The Solution

Add AgentGuard to your GitHub Actions workflow:

name: Security Scan
on: [pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dockfixlabs/agentguard@v1
        with:
          path: .
          format: sarif
          min-severity: HIGH
Enter fullscreen mode Exit fullscreen mode

That is it. Every PR gets scanned for:

  • Prompt injection (AST taint tracking, not just regex)
  • Tool abuse (shell access, eval, subprocess with shell=True)
  • Data exfiltration (external URLs, websocket, DNS exfil)
  • Credential exposure (API keys, AWS credentials, private keys)
  • Agent loop exploitation (infinite loops, unbounded recursion)
  • Trust boundary violations (self-modification, host filesystem access)
  • Insecure output handling (LLM output in innerHTML, document.write)
  • Supply chain risks (dynamic imports, unpinned dependencies)
  • Context manipulation (unbounded context, token limits)
  • Excessive agency (sudo/chmod, auto-execute without confirmation)

All 10 OWASP ASI Top 10 categories. In your CI. On every PR.

What It Catches

We scanned LangChain (1,784 files) with AgentGuard. Results:

  • 86 CRITICAL findings
  • 249 HIGH findings
  • 45 MEDIUM findings

Including: shell tools exposed to agents, self-modifying code, tainted data flowing into LLM prompts, and privilege escalation paths.

Full report: Scanning LangChain with AgentGuard

Installation Options

GitHub Action (CI/CD) 

- uses: dockfixlabs/agentguard@v1
Enter fullscreen mode Exit fullscreen mode

CLI (local) 

pip install dfx-agentguard
agentguard . --format text
Enter fullscreen mode Exit fullscreen mode

Pre-commit hook 

repos:
  - repo: https://github.com/dockfixlabs/agentguard
    rev: v0.5.4
    hooks:
      - id: agentguard
Enter fullscreen mode Exit fullscreen mode

MCP Server (for Claude Code / Cursor)

AgentGuard runs as an MCP server. Point your MCP config at it and get real-time security feedback while you code.

Open Source

MIT licensed. No signup. No API key. No cloud.

The code is on GitHub. The package is on PyPI. The benchmark is open. The tests are open.

If you build AI agents, you need this in your pipeline.

AgentGuard v0.5.4 covers all 10 OWASP ASI Top 10 categories with AST-based taint tracking for Python and JavaScript/TypeScript. 50 tests, 15/15 adversarial attacks detected, 0 false positives.

Top comments (1)

Collapse
 
aldo_cve profile image
Aldo •

The explosion of agentic AI patterns has definitely opened up a new can of worms for security teams. We've seen firsthand how traditional SAST/DAST tools often feel like they're trying to fit a square peg in a round hole when it comes to prompt injection, data exfiltration through agent outputs, or even model poisoning vectors. Pushing security left is always the goal, but the surface area for AI agents feels fundamentally different, requiring a new lens on what a "vulnerability" even looks like in this context.

Integrating security at the PR level, especially for these newer threat models, is critical. The challenge often lies in striking the right balance between comprehensive coverage and minimizing friction for developers. For something like the OWASP ASI Top 10, the devil's in the details: what specific heuristics or static analysis patterns is it employing to detect these vulnerabilities? We've found that the quality of findings and the signal-to-noise ratio are paramount when introducing any new gate in CI/CD, otherwise it just becomes another skipped check.

From an operational perspective, scan time and resource consumption are also major considerations. A one-line YAML integration is appealing for adoption, but in a busy pipeline, even a few extra minutes per PR can add up quickly. It's a constant balancing act to ensure security doesn't become a bottleneck, especially as teams push for faster iteration cycles with AI features. It's good to see more tools emerging to tackle these specific challenges.