I attacked my own repo — my PR bot blocked the attack before merge

说明与用途

AgentGuard 检测并阻止了 12 个隐藏的代理配置攻击，利用 GitHub Secret Scanning 阻止了危险推送，并在实时 PR 中阻止了攻击，无需人工干预。

问题

Coding agents can execute malicious instructions hidden in repo files, risking security breaches before code review.

结果

AgentGuard successfully detected all crafted attacks, prevented a malicious push via GitHub secret scanning, and blocked an attack in a live PR, demonstrating effective security gating for coding agents.

工作流

• 1. Build AgentGuard CI gate to scan AGENTS.md, skills, MCP servers, hooks.
• 2. Inject 12 targeted attacks into a test repo.
• 3. Run AgentGuard unit tests to confirm detection of all attacks.
• 4. Scan 30 public repos for AGENTS.md; identify 5 with critical findings.
• 5. Manually verify findings and refine rules to eliminate false positives.
• 6. Push a test commit containing a fake Slack token; GitHub secret scanning blocks the push.
• 7. Deploy AgentGuard GitHub App (Pro) to comment on PRs and run check‑runs.
• 8. Create a harmless PR; observe green check‑run and merge allowed.
• 9. Create an attack PR; observe failure check‑run and merge blocked.

证据

AgentGuard detects all 12 — deterministically, no LLM oracle — with 36 unit tests that prove it forever (12/12 detected, 0 false positives on the clean control repo).

来源

GitHub's secret scanning caught it and blocked the push.

来源

PR #2 (attack: hidden instruction with exfil in AGENTS.md): comment Note E (1 findings), check-run failure → merge blocked.

来源