node9 Agent Security Check

A GitHub Action that scans your repo's agent-security surface on every pull request and comments with what it finds — the injectable CI workflows, unsafe committed agent configs, and risky MCP servers that let an AI agent be turned against you.

It's the same engine as npx node9-ai scan-repo, wired into your PRs.

What it catches

• Injectable agent workflows — a .github/workflows/*.yml that runs an AI agent (claude-code-action, codex, aider…) on untrusted PR/issue input with your secrets and write access. The pattern behind the 2026 prompt-injection CVEs.
• Unsafe committed agent configs — .claude/settings.json hooks that run remote code on every contributor's machine, or broad tool grants that pre-authorize dangerous commands.
• Risky MCP servers — .mcp.json servers on unpinned executables, or inline credentials.

It reads committed config only, statically — it never runs your repo's code.

Quick start (same-repo PRs)

# .github/workflows/agent-security.yml
name: node9 agent-security
on: pull_request
permissions:
  contents: read
  pull-requests: write   # to post the comment
  checks: write          # to set the check-run
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: node9-ai/agent-security-action@v1

That's it — it checks out and scans your repo, then posts a sticky PR comment. It's report-only by default; make it a gate with fail-on.

Inputs

Input	Default	Description
fail-on	never	Fail the check when the worst finding is ≥ this: never | medium | high | critical
comment	true	Post a sticky PR comment
node9-version	latest	node9-ai version to run — pin for reproducibility
github-token	job token	Token for the comment + check-run

To block merges, set fail-on: critical (or high) and mark node9 agent-security a required check in your branch protection.

⚠️ Fork pull requests

For PRs from a fork (typical in open source), GitHub gives the workflow a read-only token and no secrets — so the simple setup above can't post a comment or check-run on them.

We deliberately do not work around this with pull_request_target — that's the exact dangerous pattern this Action flags, and we won't tell you to do something we'd warn you about. The safe pattern is a two-workflow split (a read-only pull_request job scans + uploads the result; a privileged workflow_run job that never touches PR code posts the comment). A first-class fork mode is on the roadmap; until then same-repo (branch) PRs are fully supported and fork PRs run the scan (visible in the Actions log) without the comment.

Practices what it preaches

This Action:

• requests least privilege (contents:read, pull-requests:write, checks:write),
• never uses pull_request_target and never executes untrusted PR code,
• pins its own dependencies to commit SHAs,
• runs itself on its own repo in CI.

What it is / isn't

It is a fast, deterministic agent-security check — not a generic AI code reviewer, and not a secret scanner (use GitGuardian/GHAS for that). It answers one question: can untrusted input reach a capability — a tool, a secret, or write access — through this repo's committed agent config?

Built by node9.