Our AI-agent scanner got it backwards. Here’s what we fixed in v1.1

说明与用途

在 v1.1 中，Agent PreShip Guard 修复了误报并添加了 AG008，以检测模型选择的破坏性调用且未经过批准。

问题

The Agent PreShip Guard GitHub Action incorrectly flagged a safe read‑only uptime check (false positive) and missed a destructive model‑chosen delete operation (false negative).

结果

After updating to v1.1, the action correctly flags only the unsafe model‑chosen destructive call and no longer mislabels a safe shell command.

工作流

• 1. Create a GitHub repository with the Agent PreShip Guard action.
• 2. Add a workflow file (.github/workflows/agent-guard.yml) that checks on pull_request and push events.
• 3. Configure the action to scan the repository path and fail on high severity findings.
• 4. Run the workflow; inline PR annotations show findings.
• 5. Update the action to v1.1 to correct false positives and add new rule AG008.

证据

== Agent A ::error AG001 Model/LLM output passed to shell ::warning AG004 shell=True in tool code Agent PreShip Guard: 1 high, 1 medium findings. == Agent B Agent PreShip Guard: 0 high, 0 medium findings.

来源

== Agent A ::warning AG004 shell=True in tool code Agent PreShip Guard: 0 high, 1 medium findings. == Agent B ::error AG008 Model output selects a destructive call with no approval gate Agent PreShip Guard: 1 high, 0 medium findings.

来源