Building an AI Agent That Can Actually Take Action

Описание и применение

Portcullis – AI‑агент, автоматически проверяющий npm‑пакет и добавляющий его в репозиторий только после явного одобрения, снижая риск внедрения вредоносного кода.

Задача

Developers add npm dependencies without inspecting the code, risking malicious or insecure packages.

Результат

Portcullis reduces risk by automatically inspecting npm packages and requiring explicit approval before modifying a repo, ensuring safe dependency management.

Рабочий процесс

• Ask Portcullis if a package can be added
• Portcullis checks package name for typosquatting
• Collects registry metadata, download stats, OSV advisories
• Downloads tarball into sandbox, unpacks, inspects install hooks and code
• Diffs against GitHub source
• Presents verdict with evidence
• If approved, creates branch, commits dependency line, opens PR

Доказательства

The agent gave me a confident, well‑structured verdict on express…

Источник

The sandbox had no bash…

Источник

The model mattered more than the prompt…

Источник