@node9/proxy 1.58.5 → 1.59.0

package/README.md

@@ -68,6 +68,53 @@ Findings are grouped by **who can fix them**: 🔒 the ones node9 reduces (just
   Track this across your fleet & keep it green → node9.ai
 ```
 
+## Scan a repo — agent-CI security
+
+`node9 scan-repo` checks any repo (or a local folder) for ways an AI agent wired into GitHub Actions could be **hijacked by an outsider** — injectable workflows, agent-reachable secrets, unpinned MCP servers, over-broad agent config, and poisoned instruction files. Static and parse-only: it reads only committed config, never executes repo code. No install or token needed for public repos.
+
+```bash
+npx node9-ai scan-repo <owner/repo>   # any public repo, no install
+node9 scan-repo .                      # a local checkout — no network
+node9 scan-repo <owner/repo> --json    # machine-readable
+```
+
+```text
+🛡️  node9 scan-repo · node9-ai/agent-security-demo · ⚠️ agent-security risk found
+   inspected 2 config file(s), 2 finding(s)
+
+🔴 CRITICAL  Injectable agent workflow — untrusted input reaches a tool-using agent with secrets
+   .github/workflows/vulnerable-example.yml · CI-2
+     • runs with base-repo secrets (pull_request_target)
+     • checks out the untrusted PR head into the workspace root
+     • allowed_non_write_users: "*" — any user can trigger the agent
+     • no effective actor gate
+
+🔴 CRITICAL  Exfiltratable secrets reachable by an injectable agent
+   .github/workflows/vulnerable-example.yml · CI-4
+     • agent has arbitrary shell (bare Bash) → can read env and exfiltrate
+```
+
+What it checks:
+
+| Check    | Flags                                                                        |
+| -------- | ---------------------------------------------------------------------------- |
+| **CI-1** | committed agent config that pre-authorizes broad tools or runs remote hooks  |
+| **CI-2** | injectable agent workflows — an outsider can trigger the agent and hijack it |
+| **CI-3** | unpinned / `@latest` MCP servers or inline credentials (supply chain)        |
+| **CI-4** | secrets an injected agent could exfiltrate                                   |
+| **CI-6** | poisoned or dangerous instructions in `CLAUDE.md` / `AGENTS.md` / skills     |
+
+**Gate every PR** — the same engine as a GitHub Action, so a hijackable config can't get merged:
+
+```yaml
+# .github/workflows/agent-security.yml
+- uses: node9-ai/agent-security-action@v1
+  with:
+    fail-on: high # or 'never' to just comment
+```
+
+Marketplace: **[node9 Agent Security Check](https://github.com/marketplace/actions/node9-agent-security-check)**
+
 ## Live monitoring
 
 <p align="center">

package/dist/cli.js

@@ -52974,7 +52974,15 @@ var SURFACE_FILES = [
   ".claude/settings.local.json",
   ".mcp.json",
   ".cursor/mcp.json",
-  ".codex/config.toml"
+  ".codex/config.toml",
+  // CI-6: agent instruction files (auto-loaded into the agent's system prompt).
+  "CLAUDE.md",
+  "AGENTS.md",
+  "GEMINI.md",
+  ".cursorrules",
+  ".github/copilot-instructions.md",
+  ".windsurfrules",
+  ".clinerules"
 ];
 var WORKFLOW_DIR = ".github/workflows";
 async function pooled(items, limit, fn) {
@@ -53164,18 +53172,32 @@ function isAgentStep(step) {
     return true;
   return false;
 }
+function allowedToolsFromArgs(claudeArgs) {
+  let out = "";
+  for (const m of claudeArgs.matchAll(/--allowed[-_]?tools[=\s]+("[^"]*"|'[^']*'|\S+)/gi))
+    out += " " + m[1];
+  return out;
+}
+function allowedToolsFromSettings(settings) {
+  let out = "";
+  for (const key of ["allowedTools", "allow"]) {
+    for (const m of settings.matchAll(new RegExp(`"${key}"\\s*:\\s*(\\[[^\\]]*\\])`, "gi")))
+      out += " " + m[1];
+  }
+  return out;
+}
 function collectTools(steps) {
-  const stripDeny = (x) => x.replace(/--disallowed[-_]?tools\s+("[^"]*"|'[^']*'|\S+)/gi, " ").replace(/["']disallowed[_]?[tT]ools["']\s*:\s*\[[^\]]*\]/g, " ");
   let s = "";
   for (const st of steps) {
     const w = st.with ?? {};
-    s += " " + stripDeny(str(w["claude_args"])) + " " + str(w["allowed_tools"]) + " " + str(w["allowedTools"]);
-    s += " " + stripDeny(str(w["settings"]));
+    s += " " + allowedToolsFromArgs(str(w["claude_args"]));
+    s += " " + str(w["allowed_tools"]) + " " + str(w["allowedTools"]);
+    s += " " + allowedToolsFromSettings(str(w["settings"]));
   }
   return s;
 }
-function untrustedHeadCheckout(wf) {
-  for (const { step } of allSteps(wf)) {
+function untrustedHeadCheckout(steps) {
+  for (const step of steps) {
     if (!step.uses || !/actions\/checkout/.test(step.uses)) continue;
     const ref = str(step.with?.["ref"]);
     if (/pull_request\.head|head[._]sha|head_ref|expected_head|workflow_run\.head|inputs\.[\w]*head/i.test(
@@ -53194,24 +53216,44 @@ function promptTakesUntrusted(steps) {
   }
   return false;
 }
-function hasActorGate(wf, raw) {
+var ACTOR_GATE_RE = /author_association|FIRST_TIME_CONTRIBUTOR|collaborator|\b(MEMBER|OWNER)\b|permission|github\.actor\s*==|user\.login\s*==|==\s*['"](write|admin|maintain)|contains\([^)]*(login|actor|association)|head\.repo\.full_name\s*==\s*github\.repository/i;
+function labelTypeConfigured(wf, raw) {
   const on = wf.on ?? raw["on"] ?? raw[true];
   const prTypes = (t) => t && Array.isArray(t.types) ? t.types.map(String) : [];
-  const labeled = prTypes(on?.["pull_request_target"]).includes("labeled") || prTypes(on?.["pull_request"]).includes("labeled");
+  return prTypes(on?.["pull_request_target"]).includes("labeled") || prTypes(on?.["pull_request"]).includes("labeled");
+}
+function ifsAreGated(ifs, labelConfigured) {
+  const gated = ACTOR_GATE_RE.test(ifs);
+  const labelGated = labelConfigured && /event\.label|label\.name/i.test(ifs);
+  return gated || labelGated;
+}
+function hasActorGate(wf, raw) {
   const ifs = [
     wf.jobs ? Object.values(wf.jobs).map((j) => j.if) : [],
     allSteps(wf).map((s) => s.step.if)
   ].flat().map(str).join(" ");
-  const gated = /author_association|FIRST_TIME_CONTRIBUTOR|collaborator|\b(MEMBER|OWNER)\b|permission|github\.actor\s*==|user\.login\s*==|==\s*['"](write|admin|maintain)|contains\([^)]*(login|actor|association)|head\.repo\.full_name\s*==\s*github\.repository/i.test(
-    ifs
-  );
-  const labelGated = !!labeled && /event\.label|label\.name/i.test(ifs);
-  return gated || labelGated;
+  return ifsAreGated(ifs, labelTypeConfigured(wf, raw));
+}
+function jobActorGate(job, wf, raw) {
+  const ifs = [job.if, ...(job.steps ?? []).map((s) => s.if)].map(str).join(" ");
+  return ifsAreGated(ifs, labelTypeConfigured(wf, raw)) || /assignee\.login\s*==|event\.assignee\b/i.test(ifs);
 }
 function hasImplicitActorGate(agentSteps, bypassActive) {
   if (bypassActive) return false;
   return agentSteps.some((s) => /anthropics\/claude-code-action@/i.test(s.uses ?? ""));
 }
+function injectableAgentSteps(wf, raw, untrustedTrigger) {
+  const out = [];
+  for (const job of Object.values(wf.jobs ?? {})) {
+    const a = (job.steps ?? []).filter(isAgentStep);
+    if (!a.length) continue;
+    const jobStar = str(a.map((s) => s.with?.["allowed_non_write_users"]).find(Boolean)) === "*";
+    const jobBypass = jobStar && untrustedTrigger;
+    if (jobActorGate(job, wf, raw) || hasImplicitActorGate(a, jobBypass)) continue;
+    out.push(...a);
+  }
+  return out;
+}
 function permsElevated(wf, agentJobs) {
   const check = (p) => {
     const s = str(p);
@@ -53274,14 +53316,16 @@ function analyzeWorkflow(path70, content) {
   const nonWriteList = !!nonWrite && nonWrite !== "*";
   const untrustedTrigger = secretExposed || forkInput;
   const bypassActive = nonWriteStar && untrustedTrigger;
-  const head = untrustedHeadCheckout(wf);
+  const head = untrustedHeadCheckout(steps);
   const promptUntrusted = promptTakesUntrusted(agentSteps);
-  const reach = Math.max(
+  const reach = untrustedTrigger ? Math.max(
     head === "root" ? 3 : head === "subdir" ? 1 : 0,
     promptUntrusted ? 2 : 0,
     bypassActive ? 2 : 0
-  );
-  const toolsBlob = collectTools(agentSteps);
+  ) : 0;
+  const powerSteps = injectableAgentSteps(wf, raw, untrustedTrigger);
+  const scopedSteps = powerSteps.length ? powerSteps : agentSteps;
+  const toolsBlob = collectTools(scopedSteps);
   const broadTools = BROAD_TOOL_RE.test(toolsBlob);
   const elevated = permsElevated(wf, agentJobs);
   const pat = usesPat(wf);
@@ -53346,6 +53390,105 @@ function analyzeWorkflow(path70, content) {
     fix: head === "root" && privileged ? "Do not check out the untrusted PR head into the workspace root under a privileged trigger (pull_request_target/workflow_run) \u2014 check out the base ref, or isolate the head in a subdir (--add-dir). Add an actor gate and scope the agent tools." : head === "root" ? "This runs under `pull_request` (fork PRs get a read-only token), so the head checkout is low-risk today \u2014 keep it on `pull_request` (not `pull_request_target`) and keep the actor gate + scoped tools." : "Add/verify an actor gate, scope the agent tools to read-only, and env-deny secrets. See Anthropic\u2019s claude-code-action security doc."
   };
 }
+var AGENT_FUEL_RE = /^(ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|ANTHROPIC_BASE_URL|CLAUDE_CODE_OAUTH_TOKEN|OPENAI_API_KEY|OPENAI_BASE_URL|GEMINI_API_KEY|GOOGLE_API_KEY|GITHUB_TOKEN)$/i;
+var FUEL_INPUT_KEYS = /^(anthropic_api_key|anthropic_auth_token|anthropic_base_url|claude_code_oauth_token|openai_api_key|openai_base_url|gemini_api_key|google_api_key)$/i;
+function fuelSecretNames(agentSteps) {
+  const out = /* @__PURE__ */ new Set();
+  const add = (v) => {
+    for (const m of str(v).matchAll(/secrets\.([A-Za-z_][A-Za-z0-9_]*)/gi)) out.add(m[1]);
+  };
+  for (const st of agentSteps) {
+    for (const [k, v] of Object.entries(st.with ?? {})) if (FUEL_INPUT_KEYS.test(k)) add(v);
+    for (const [k, v] of Object.entries(st.env ?? {})) if (AGENT_FUEL_RE.test(k)) add(v);
+  }
+  return out;
+}
+function classifySecret(name) {
+  if (/AWS_|AZURE_|GCP_|GOOGLE_APPLICATION|GCLOUD/i.test(name)) return "cloud";
+  if (/_PAT\b|PAT$|_TOKEN$|GH_TOKEN/i.test(name)) return "pat";
+  if (/DATABASE|_DB_|POSTGRES|MYSQL|REDIS|MONGO|CONNECTION_STRING/i.test(name)) return "db";
+  if (/API_KEY|_KEY$|SECRET|PASSWORD|PASSWD/i.test(name)) return "api-key";
+  return "generic";
+}
+function agentReachableSecrets(wf, agentSteps, agentJobs) {
+  const blobs = [];
+  for (const st of agentSteps) blobs.push(str(st.env), str(st.with));
+  for (const j of agentJobs) blobs.push(str(j.env));
+  blobs.push(str(wf.env));
+  const fuel = fuelSecretNames(agentSteps);
+  const found = /* @__PURE__ */ new Map();
+  for (const b of blobs) {
+    for (const m of b.matchAll(/secrets\.([A-Za-z_][A-Za-z0-9_]*)/gi)) {
+      const name = m[1];
+      if (AGENT_FUEL_RE.test(name) || fuel.has(name)) continue;
+      found.set(name, classifySecret(name));
+    }
+  }
+  const idToken = /["']?id-token["']?\s*:\s*["']?write/i.test(str(wf.permissions)) || agentJobs.some((j) => /["']?id-token["']?\s*:\s*["']?write/i.test(str(j.permissions)));
+  const out = [...found].map(([name, kind]) => ({ name, kind }));
+  if (idToken) out.push({ name: "id-token (cloud OIDC)", kind: "cloud-oidc" });
+  return out;
+}
+function evalAgentJob(job, wf, raw, untrustedTrigger) {
+  const jobSteps = job.steps ?? [];
+  const jobAgentSteps = jobSteps.filter(isAgentStep);
+  if (jobAgentSteps.length === 0) return null;
+  const secrets = agentReachableSecrets(wf, jobAgentSteps, [job]);
+  if (secrets.length === 0) return null;
+  const nonWriteStar = str(jobAgentSteps.map((s) => s.with?.["allowed_non_write_users"]).find(Boolean)) === "*";
+  const bypassActive = nonWriteStar && untrustedTrigger;
+  const head = untrustedHeadCheckout(jobSteps);
+  const reach = Math.max(
+    head === "root" ? 3 : head === "subdir" ? 1 : 0,
+    promptTakesUntrusted(jobAgentSteps) ? 2 : 0,
+    bypassActive ? 2 : 0
+  );
+  const gate = jobActorGate(job, wf, raw) || hasImplicitActorGate(jobAgentSteps, bypassActive);
+  const injectable = untrustedTrigger && !gate && reach > 0;
+  const canReadEnv = EXFIL_RCE_RE.test(collectTools(jobAgentSteps));
+  const realSecrets = secrets.filter((s) => s.kind !== "cloud-oidc");
+  const hasOidc = secrets.some((s) => s.kind === "cloud-oidc");
+  let severity;
+  if (injectable && canReadEnv) {
+    severity = hasOidc || realSecrets.some((s) => ["cloud", "pat", "db"].includes(s.kind)) ? "critical" : "high";
+  } else if (realSecrets.length > 0) {
+    severity = "advisory";
+  } else {
+    return null;
+  }
+  return { severity, secrets, injectable, canReadEnv };
+}
+function analyzeWorkflowSecrets(path70, content) {
+  let raw;
+  try {
+    raw = (0, import_yaml.parse)(content) ?? {};
+  } catch {
+    return null;
+  }
+  const wf = raw;
+  const all = allSteps(wf);
+  if (!all.some((s) => isAgentStep(s.step))) return null;
+  const triggers = triggerKeys(wf, raw);
+  const untrustedTrigger = triggers.some(
+    (t) => /pull_request_target|workflow_run|issue|pull_request|workflow_call/i.test(t)
+  );
+  const agentJobs = [...new Set(all.filter((s) => isAgentStep(s.step)).map((s) => s.job))];
+  const worst = agentJobs.map((job) => evalAgentJob(job, wf, raw, untrustedTrigger)).filter((e) => e !== null).sort((a, b) => SEVERITY_RANK2[b.severity] - SEVERITY_RANK2[a.severity])[0];
+  if (!worst) return null;
+  return {
+    check: "CI-4",
+    dimension: "data",
+    severity: worst.severity,
+    title: worst.severity === "advisory" ? "Secrets reachable by the agent \u2014 hardening" : "Exfiltratable secrets reachable by an injectable agent",
+    file: path70,
+    signals: [
+      `agent can reach: ${worst.secrets.map((s) => s.name).join(", ")}`,
+      worst.injectable ? "the agent is externally triggerable (untrusted trigger, no gate)" : "gated / not externally triggerable \u2014 latent risk only",
+      worst.canReadEnv ? "agent has arbitrary shell (bare Bash) \u2192 can read env and exfiltrate" : "no arbitrary-shell tool \u2014 not exfiltratable today, but one tool-add away"
+    ],
+    fix: "Move extra secrets to a separate trusted job the agent cannot reach; drop id-token:write if unused; scope the agent tools to read-only and gate the trigger."
+  };
+}
 
 // src/ci-check/agent-config.ts
 function asStrings(v) {
@@ -53456,6 +53599,106 @@ function analyzeMcp(path70, content) {
   return findings;
 }
 
+// src/ci-check/instructions.ts
+var HIDDEN_CHARS = /[\u200B\u2060\u202A-\u202E\u2066-\u2069]|[\u{E0000}-\u{E007F}]/u;
+var OVERRIDE_RE = /ignore\s+(all\s+)?(previous|prior|the\s+above)\s+(instructions|prompts?|rules)|disregard\s+(the\s+|your\s+)?(system\s+)?(prompt|instructions|rules)|forget\s+(everything|all\s+(previous|prior))|you\s+are\s+now\s+(a|an|the)\b|<\/?system>/i;
+var FETCH_OBEY_RE = /\b(curl|wget|iwr|invoke-webrequest)\b[^\n|]*\|\s*(bash|sh|zsh|python3?|node|iex)\b|\b(curl|wget)\b[^\n]*&&[^\n]*\b(bash|sh)\b/i;
+var SECRET_PATH_RE = /~\/\.aws\/credentials|~\/\.ssh\/id_[a-z]+|~\/\.config\/gh\/hosts|read\s+the\s+(token|secret|api[_ ]?key|password)\s+(in|from)\s+[.`'"]?\.?env/i;
+var EXFIL_RE = /\b(post|send|upload|exfiltrate|forward)\b[^\n]{0,40}\b(to|at)\b[^\n]{0,50}(https?:\/\/|webhook|hook\.[a-z])/i;
+var HUMAN_SECTION_RE = /^#+\s*(install|installation|setup|set ?up|getting started|quick ?start|contributing|contribution|development|dev setup|build|prerequisites|requirements|usage)\b/i;
+var NEGATION_RE = /\b(never|do not|don'?t|avoid|must not|should not|no need to|refuse to)\b/i;
+function isNegated(text, idx) {
+  return NEGATION_RE.test(text.slice(Math.max(0, idx - 40), idx));
+}
+function inHumanSection(text, idx) {
+  const heading = text.slice(0, idx).split("\n").reverse().find((l) => /^#+\s/.test(l));
+  return !!heading && HUMAN_SECTION_RE.test(heading);
+}
+function decodeSuspiciousBase64(text) {
+  let out = "";
+  for (const m of text.matchAll(/[A-Za-z0-9+/]{40,}={0,2}/g)) {
+    try {
+      const d = Buffer.from(m[0], "base64").toString("utf8");
+      if (/[\x20-\x7E]{16,}/.test(d) && /[a-z]{4,}/i.test(d)) out += " " + d;
+    } catch {
+    }
+  }
+  return out;
+}
+function mk(severity, title, signals, fix, path70) {
+  return { check: "CI-6", dimension: "instructions", severity, title, file: path70, signals, fix };
+}
+function analyzeInstructionFile(path70, content) {
+  const findings = [];
+  const decoded = decodeSuspiciousBase64(content);
+  if (HIDDEN_CHARS.test(content)) {
+    findings.push(
+      mk(
+        "critical",
+        "Hidden characters in an agent instruction file",
+        [
+          "contains zero-width / bidi / Unicode-tag characters \u2014 a technique to hide instructions from human review while the agent still reads them"
+        ],
+        "Remove the hidden characters. Instruction files must be plain, reviewable text.",
+        path70
+      )
+    );
+  }
+  const ov = OVERRIDE_RE.exec(content);
+  const ovEnc = !ov ? OVERRIDE_RE.exec(decoded) : null;
+  if (ov || ovEnc) {
+    const m = ov || ovEnc;
+    findings.push(
+      mk(
+        ovEnc ? "critical" : "high",
+        "Prompt-override directive in an agent instruction file",
+        [
+          `contains a prompt-override / role-impersonation directive (\`${m[0].slice(0, 60).trim()}\`)${ovEnc ? " \u2014 concealed in a base64 blob" : ""}`
+        ],
+        "Remove the override text. An instruction file should not tell the agent to ignore its own rules.",
+        path70
+      )
+    );
+  }
+  const fo = FETCH_OBEY_RE.exec(content);
+  if (fo && !inHumanSection(content, fo.index) && !isNegated(content, fo.index)) {
+    findings.push(
+      mk(
+        "medium",
+        "Instruction directs the agent to fetch and run remote code",
+        [`\`${fo[0].slice(0, 70).trim()}\` \u2014 fetch-and-obey, outside an install/setup section`],
+        "Do not instruct the agent to pipe remote content into a shell; pin and vendor scripts instead.",
+        path70
+      )
+    );
+  }
+  const sp = SECRET_PATH_RE.exec(content);
+  if (sp && !isNegated(content, sp.index)) {
+    findings.push(
+      mk(
+        "medium",
+        "Instruction points the agent at credential material",
+        [`references \`${sp[0].slice(0, 50).trim()}\` \u2014 directs the agent toward secrets`],
+        "Do not reference credential files or paths in agent instructions.",
+        path70
+      )
+    );
+  }
+  const ex = EXFIL_RE.exec(content);
+  if (ex && !inHumanSection(content, ex.index) && !isNegated(content, ex.index)) {
+    findings.push(
+      mk(
+        "medium",
+        "Instruction directs the agent to send data to an external endpoint",
+        [`\`${ex[0].slice(0, 70).trim()}\` \u2014 possible exfiltration directive`],
+        "Remove external post/upload directives from agent instructions.",
+        path70
+      )
+    );
+  }
+  return findings;
+}
+
 // src/ci-check/index.ts
 function worstOf(findings) {
   let worst = null;
@@ -53474,10 +53717,16 @@ function scanTree(tree) {
       if (/\.github\/workflows\/.+\.ya?ml$/.test(file.path)) {
         const f = analyzeWorkflow(file.path, file.content);
         if (f) findings.push(f);
+        const s = analyzeWorkflowSecrets(file.path, file.content);
+        if (s) findings.push(s);
       } else if (/\.claude\/settings(\.local)?\.json$/.test(file.path)) {
         findings.push(...analyzeAgentConfig(file.path, file.content));
       } else if (/\.mcp\.json$|\.cursor\/mcp\.json$/.test(file.path)) {
         findings.push(...analyzeMcp(file.path, file.content));
+      } else if (/(^|\/)(CLAUDE|AGENTS|GEMINI)\.md$|(^|\/)\.cursorrules$|copilot-instructions\.md$|(^|\/)\.(windsurf|cline)rules$/.test(
+        file.path
+      )) {
+        findings.push(...analyzeInstructionFile(file.path, file.content));
       }
     } catch (err2) {
       notes.push(`checker degraded on ${file.path}: ${err2?.message ?? "error"}`);
@@ -53508,6 +53757,36 @@ var COLOR = {
   medium: import_chalk29.default.yellow,
   advisory: import_chalk29.default.gray
 };
+var ACTION_URL = "https://github.com/marketplace/actions/node9-agent-security-check?ref=cli_scan_repo";
+function renderCta(res) {
+  const L = [];
+  L.push(import_chalk29.default.dim("   " + "\u2500".repeat(63)));
+  if (res.worst === "critical" || res.worst === "high") {
+    const n = res.findings.filter((f) => f.severity === "critical" || f.severity === "high").length;
+    L.push(
+      "   " + import_chalk29.default.red.bold(
+        `\u{1F534} ${n} ${n === 1 ? "issue" : "issues"} to fix \u2014 then stop the next at the PR.`
+      )
+    );
+    L.push("");
+    L.push("   " + import_chalk29.default.bold("Catch this class of issue on every PR, automatically:"));
+  } else if (res.worst) {
+    L.push("   " + import_chalk29.default.yellow("\u{1F7E1} Review the findings above, then keep it covered:"));
+    L.push("");
+    L.push("   " + import_chalk29.default.bold("Check every PR for agent-CI risk:"));
+  } else if (res.incomplete) {
+    L.push("   " + import_chalk29.default.yellow.bold("\u26A0\uFE0F  Incomplete \u2014 not a clean bill of health."));
+    L.push("");
+    L.push("   " + import_chalk29.default.bold("Get a complete check on every PR (CI reads the tree directly):"));
+  } else {
+    L.push("   " + import_chalk29.default.green("\u2705 Agent CI is well-configured \u2014 0 unmitigated issues."));
+    L.push("");
+    L.push("   " + import_chalk29.default.bold("Keep it green as you add agent workflows \u2014 check every PR:"));
+  }
+  L.push("   " + import_chalk29.default.dim("\u2192 ") + import_chalk29.default.cyan.underline(ACTION_URL));
+  L.push("   " + import_chalk29.default.gray("  zero setup \xB7 no token \xB7 runs in your CI"));
+  return L;
+}
 function ownedHint(source) {
   return source.startsWith("/") || source.startsWith(".") || source.startsWith("~");
 }
@@ -53552,6 +53831,8 @@ function renderScan(res) {
       )
     );
   }
+  L.push("");
+  L.push(...renderCta(res));
   return L.join("\n");
 }
 function renderScanMarkdown(res) {

package/dist/cli.mjs

@@ -52967,7 +52967,15 @@ var SURFACE_FILES = [
   ".claude/settings.local.json",
   ".mcp.json",
   ".cursor/mcp.json",
-  ".codex/config.toml"
+  ".codex/config.toml",
+  // CI-6: agent instruction files (auto-loaded into the agent's system prompt).
+  "CLAUDE.md",
+  "AGENTS.md",
+  "GEMINI.md",
+  ".cursorrules",
+  ".github/copilot-instructions.md",
+  ".windsurfrules",
+  ".clinerules"
 ];
 var WORKFLOW_DIR = ".github/workflows";
 async function pooled(items, limit, fn) {
@@ -53157,18 +53165,32 @@ function isAgentStep(step) {
     return true;
   return false;
 }
+function allowedToolsFromArgs(claudeArgs) {
+  let out = "";
+  for (const m of claudeArgs.matchAll(/--allowed[-_]?tools[=\s]+("[^"]*"|'[^']*'|\S+)/gi))
+    out += " " + m[1];
+  return out;
+}
+function allowedToolsFromSettings(settings) {
+  let out = "";
+  for (const key of ["allowedTools", "allow"]) {
+    for (const m of settings.matchAll(new RegExp(`"${key}"\\s*:\\s*(\\[[^\\]]*\\])`, "gi")))
+      out += " " + m[1];
+  }
+  return out;
+}
 function collectTools(steps) {
-  const stripDeny = (x) => x.replace(/--disallowed[-_]?tools\s+("[^"]*"|'[^']*'|\S+)/gi, " ").replace(/["']disallowed[_]?[tT]ools["']\s*:\s*\[[^\]]*\]/g, " ");
   let s = "";
   for (const st of steps) {
     const w = st.with ?? {};
-    s += " " + stripDeny(str(w["claude_args"])) + " " + str(w["allowed_tools"]) + " " + str(w["allowedTools"]);
-    s += " " + stripDeny(str(w["settings"]));
+    s += " " + allowedToolsFromArgs(str(w["claude_args"]));
+    s += " " + str(w["allowed_tools"]) + " " + str(w["allowedTools"]);
+    s += " " + allowedToolsFromSettings(str(w["settings"]));
   }
   return s;
 }
-function untrustedHeadCheckout(wf) {
-  for (const { step } of allSteps(wf)) {
+function untrustedHeadCheckout(steps) {
+  for (const step of steps) {
     if (!step.uses || !/actions\/checkout/.test(step.uses)) continue;
     const ref = str(step.with?.["ref"]);
     if (/pull_request\.head|head[._]sha|head_ref|expected_head|workflow_run\.head|inputs\.[\w]*head/i.test(
@@ -53187,24 +53209,44 @@ function promptTakesUntrusted(steps) {
   }
   return false;
 }
-function hasActorGate(wf, raw) {
+var ACTOR_GATE_RE = /author_association|FIRST_TIME_CONTRIBUTOR|collaborator|\b(MEMBER|OWNER)\b|permission|github\.actor\s*==|user\.login\s*==|==\s*['"](write|admin|maintain)|contains\([^)]*(login|actor|association)|head\.repo\.full_name\s*==\s*github\.repository/i;
+function labelTypeConfigured(wf, raw) {
   const on = wf.on ?? raw["on"] ?? raw[true];
   const prTypes = (t) => t && Array.isArray(t.types) ? t.types.map(String) : [];
-  const labeled = prTypes(on?.["pull_request_target"]).includes("labeled") || prTypes(on?.["pull_request"]).includes("labeled");
+  return prTypes(on?.["pull_request_target"]).includes("labeled") || prTypes(on?.["pull_request"]).includes("labeled");
+}
+function ifsAreGated(ifs, labelConfigured) {
+  const gated = ACTOR_GATE_RE.test(ifs);
+  const labelGated = labelConfigured && /event\.label|label\.name/i.test(ifs);
+  return gated || labelGated;
+}
+function hasActorGate(wf, raw) {
   const ifs = [
     wf.jobs ? Object.values(wf.jobs).map((j) => j.if) : [],
     allSteps(wf).map((s) => s.step.if)
   ].flat().map(str).join(" ");
-  const gated = /author_association|FIRST_TIME_CONTRIBUTOR|collaborator|\b(MEMBER|OWNER)\b|permission|github\.actor\s*==|user\.login\s*==|==\s*['"](write|admin|maintain)|contains\([^)]*(login|actor|association)|head\.repo\.full_name\s*==\s*github\.repository/i.test(
-    ifs
-  );
-  const labelGated = !!labeled && /event\.label|label\.name/i.test(ifs);
-  return gated || labelGated;
+  return ifsAreGated(ifs, labelTypeConfigured(wf, raw));
+}
+function jobActorGate(job, wf, raw) {
+  const ifs = [job.if, ...(job.steps ?? []).map((s) => s.if)].map(str).join(" ");
+  return ifsAreGated(ifs, labelTypeConfigured(wf, raw)) || /assignee\.login\s*==|event\.assignee\b/i.test(ifs);
 }
 function hasImplicitActorGate(agentSteps, bypassActive) {
   if (bypassActive) return false;
   return agentSteps.some((s) => /anthropics\/claude-code-action@/i.test(s.uses ?? ""));
 }
+function injectableAgentSteps(wf, raw, untrustedTrigger) {
+  const out = [];
+  for (const job of Object.values(wf.jobs ?? {})) {
+    const a = (job.steps ?? []).filter(isAgentStep);
+    if (!a.length) continue;
+    const jobStar = str(a.map((s) => s.with?.["allowed_non_write_users"]).find(Boolean)) === "*";
+    const jobBypass = jobStar && untrustedTrigger;
+    if (jobActorGate(job, wf, raw) || hasImplicitActorGate(a, jobBypass)) continue;
+    out.push(...a);
+  }
+  return out;
+}
 function permsElevated(wf, agentJobs) {
   const check = (p) => {
     const s = str(p);
@@ -53267,14 +53309,16 @@ function analyzeWorkflow(path70, content) {
   const nonWriteList = !!nonWrite && nonWrite !== "*";
   const untrustedTrigger = secretExposed || forkInput;
   const bypassActive = nonWriteStar && untrustedTrigger;
-  const head = untrustedHeadCheckout(wf);
+  const head = untrustedHeadCheckout(steps);
   const promptUntrusted = promptTakesUntrusted(agentSteps);
-  const reach = Math.max(
+  const reach = untrustedTrigger ? Math.max(
     head === "root" ? 3 : head === "subdir" ? 1 : 0,
     promptUntrusted ? 2 : 0,
     bypassActive ? 2 : 0
-  );
-  const toolsBlob = collectTools(agentSteps);
+  ) : 0;
+  const powerSteps = injectableAgentSteps(wf, raw, untrustedTrigger);
+  const scopedSteps = powerSteps.length ? powerSteps : agentSteps;
+  const toolsBlob = collectTools(scopedSteps);
   const broadTools = BROAD_TOOL_RE.test(toolsBlob);
   const elevated = permsElevated(wf, agentJobs);
   const pat = usesPat(wf);
@@ -53339,6 +53383,105 @@ function analyzeWorkflow(path70, content) {
     fix: head === "root" && privileged ? "Do not check out the untrusted PR head into the workspace root under a privileged trigger (pull_request_target/workflow_run) \u2014 check out the base ref, or isolate the head in a subdir (--add-dir). Add an actor gate and scope the agent tools." : head === "root" ? "This runs under `pull_request` (fork PRs get a read-only token), so the head checkout is low-risk today \u2014 keep it on `pull_request` (not `pull_request_target`) and keep the actor gate + scoped tools." : "Add/verify an actor gate, scope the agent tools to read-only, and env-deny secrets. See Anthropic\u2019s claude-code-action security doc."
   };
 }
+var AGENT_FUEL_RE = /^(ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|ANTHROPIC_BASE_URL|CLAUDE_CODE_OAUTH_TOKEN|OPENAI_API_KEY|OPENAI_BASE_URL|GEMINI_API_KEY|GOOGLE_API_KEY|GITHUB_TOKEN)$/i;
+var FUEL_INPUT_KEYS = /^(anthropic_api_key|anthropic_auth_token|anthropic_base_url|claude_code_oauth_token|openai_api_key|openai_base_url|gemini_api_key|google_api_key)$/i;
+function fuelSecretNames(agentSteps) {
+  const out = /* @__PURE__ */ new Set();
+  const add = (v) => {
+    for (const m of str(v).matchAll(/secrets\.([A-Za-z_][A-Za-z0-9_]*)/gi)) out.add(m[1]);
+  };
+  for (const st of agentSteps) {
+    for (const [k, v] of Object.entries(st.with ?? {})) if (FUEL_INPUT_KEYS.test(k)) add(v);
+    for (const [k, v] of Object.entries(st.env ?? {})) if (AGENT_FUEL_RE.test(k)) add(v);
+  }
+  return out;
+}
+function classifySecret(name) {
+  if (/AWS_|AZURE_|GCP_|GOOGLE_APPLICATION|GCLOUD/i.test(name)) return "cloud";
+  if (/_PAT\b|PAT$|_TOKEN$|GH_TOKEN/i.test(name)) return "pat";
+  if (/DATABASE|_DB_|POSTGRES|MYSQL|REDIS|MONGO|CONNECTION_STRING/i.test(name)) return "db";
+  if (/API_KEY|_KEY$|SECRET|PASSWORD|PASSWD/i.test(name)) return "api-key";
+  return "generic";
+}
+function agentReachableSecrets(wf, agentSteps, agentJobs) {
+  const blobs = [];
+  for (const st of agentSteps) blobs.push(str(st.env), str(st.with));
+  for (const j of agentJobs) blobs.push(str(j.env));
+  blobs.push(str(wf.env));
+  const fuel = fuelSecretNames(agentSteps);
+  const found = /* @__PURE__ */ new Map();
+  for (const b of blobs) {
+    for (const m of b.matchAll(/secrets\.([A-Za-z_][A-Za-z0-9_]*)/gi)) {
+      const name = m[1];
+      if (AGENT_FUEL_RE.test(name) || fuel.has(name)) continue;
+      found.set(name, classifySecret(name));
+    }
+  }
+  const idToken = /["']?id-token["']?\s*:\s*["']?write/i.test(str(wf.permissions)) || agentJobs.some((j) => /["']?id-token["']?\s*:\s*["']?write/i.test(str(j.permissions)));
+  const out = [...found].map(([name, kind]) => ({ name, kind }));
+  if (idToken) out.push({ name: "id-token (cloud OIDC)", kind: "cloud-oidc" });
+  return out;
+}
+function evalAgentJob(job, wf, raw, untrustedTrigger) {
+  const jobSteps = job.steps ?? [];
+  const jobAgentSteps = jobSteps.filter(isAgentStep);
+  if (jobAgentSteps.length === 0) return null;
+  const secrets = agentReachableSecrets(wf, jobAgentSteps, [job]);
+  if (secrets.length === 0) return null;
+  const nonWriteStar = str(jobAgentSteps.map((s) => s.with?.["allowed_non_write_users"]).find(Boolean)) === "*";
+  const bypassActive = nonWriteStar && untrustedTrigger;
+  const head = untrustedHeadCheckout(jobSteps);
+  const reach = Math.max(
+    head === "root" ? 3 : head === "subdir" ? 1 : 0,
+    promptTakesUntrusted(jobAgentSteps) ? 2 : 0,
+    bypassActive ? 2 : 0
+  );
+  const gate = jobActorGate(job, wf, raw) || hasImplicitActorGate(jobAgentSteps, bypassActive);
+  const injectable = untrustedTrigger && !gate && reach > 0;
+  const canReadEnv = EXFIL_RCE_RE.test(collectTools(jobAgentSteps));
+  const realSecrets = secrets.filter((s) => s.kind !== "cloud-oidc");
+  const hasOidc = secrets.some((s) => s.kind === "cloud-oidc");
+  let severity;
+  if (injectable && canReadEnv) {
+    severity = hasOidc || realSecrets.some((s) => ["cloud", "pat", "db"].includes(s.kind)) ? "critical" : "high";
+  } else if (realSecrets.length > 0) {
+    severity = "advisory";
+  } else {
+    return null;
+  }
+  return { severity, secrets, injectable, canReadEnv };
+}
+function analyzeWorkflowSecrets(path70, content) {
+  let raw;
+  try {
+    raw = parseYaml(content) ?? {};
+  } catch {
+    return null;
+  }
+  const wf = raw;
+  const all = allSteps(wf);
+  if (!all.some((s) => isAgentStep(s.step))) return null;
+  const triggers = triggerKeys(wf, raw);
+  const untrustedTrigger = triggers.some(
+    (t) => /pull_request_target|workflow_run|issue|pull_request|workflow_call/i.test(t)
+  );
+  const agentJobs = [...new Set(all.filter((s) => isAgentStep(s.step)).map((s) => s.job))];
+  const worst = agentJobs.map((job) => evalAgentJob(job, wf, raw, untrustedTrigger)).filter((e) => e !== null).sort((a, b) => SEVERITY_RANK2[b.severity] - SEVERITY_RANK2[a.severity])[0];
+  if (!worst) return null;
+  return {
+    check: "CI-4",
+    dimension: "data",
+    severity: worst.severity,
+    title: worst.severity === "advisory" ? "Secrets reachable by the agent \u2014 hardening" : "Exfiltratable secrets reachable by an injectable agent",
+    file: path70,
+    signals: [
+      `agent can reach: ${worst.secrets.map((s) => s.name).join(", ")}`,
+      worst.injectable ? "the agent is externally triggerable (untrusted trigger, no gate)" : "gated / not externally triggerable \u2014 latent risk only",
+      worst.canReadEnv ? "agent has arbitrary shell (bare Bash) \u2192 can read env and exfiltrate" : "no arbitrary-shell tool \u2014 not exfiltratable today, but one tool-add away"
+    ],
+    fix: "Move extra secrets to a separate trusted job the agent cannot reach; drop id-token:write if unused; scope the agent tools to read-only and gate the trigger."
+  };
+}
 
 // src/ci-check/agent-config.ts
 function asStrings(v) {
@@ -53449,6 +53592,106 @@ function analyzeMcp(path70, content) {
   return findings;
 }
 
+// src/ci-check/instructions.ts
+var HIDDEN_CHARS = /[\u200B\u2060\u202A-\u202E\u2066-\u2069]|[\u{E0000}-\u{E007F}]/u;
+var OVERRIDE_RE = /ignore\s+(all\s+)?(previous|prior|the\s+above)\s+(instructions|prompts?|rules)|disregard\s+(the\s+|your\s+)?(system\s+)?(prompt|instructions|rules)|forget\s+(everything|all\s+(previous|prior))|you\s+are\s+now\s+(a|an|the)\b|<\/?system>/i;
+var FETCH_OBEY_RE = /\b(curl|wget|iwr|invoke-webrequest)\b[^\n|]*\|\s*(bash|sh|zsh|python3?|node|iex)\b|\b(curl|wget)\b[^\n]*&&[^\n]*\b(bash|sh)\b/i;
+var SECRET_PATH_RE = /~\/\.aws\/credentials|~\/\.ssh\/id_[a-z]+|~\/\.config\/gh\/hosts|read\s+the\s+(token|secret|api[_ ]?key|password)\s+(in|from)\s+[.`'"]?\.?env/i;
+var EXFIL_RE = /\b(post|send|upload|exfiltrate|forward)\b[^\n]{0,40}\b(to|at)\b[^\n]{0,50}(https?:\/\/|webhook|hook\.[a-z])/i;
+var HUMAN_SECTION_RE = /^#+\s*(install|installation|setup|set ?up|getting started|quick ?start|contributing|contribution|development|dev setup|build|prerequisites|requirements|usage)\b/i;
+var NEGATION_RE = /\b(never|do not|don'?t|avoid|must not|should not|no need to|refuse to)\b/i;
+function isNegated(text, idx) {
+  return NEGATION_RE.test(text.slice(Math.max(0, idx - 40), idx));
+}
+function inHumanSection(text, idx) {
+  const heading = text.slice(0, idx).split("\n").reverse().find((l) => /^#+\s/.test(l));
+  return !!heading && HUMAN_SECTION_RE.test(heading);
+}
+function decodeSuspiciousBase64(text) {
+  let out = "";
+  for (const m of text.matchAll(/[A-Za-z0-9+/]{40,}={0,2}/g)) {
+    try {
+      const d = Buffer.from(m[0], "base64").toString("utf8");
+      if (/[\x20-\x7E]{16,}/.test(d) && /[a-z]{4,}/i.test(d)) out += " " + d;
+    } catch {
+    }
+  }
+  return out;
+}
+function mk(severity, title, signals, fix, path70) {
+  return { check: "CI-6", dimension: "instructions", severity, title, file: path70, signals, fix };
+}
+function analyzeInstructionFile(path70, content) {
+  const findings = [];
+  const decoded = decodeSuspiciousBase64(content);
+  if (HIDDEN_CHARS.test(content)) {
+    findings.push(
+      mk(
+        "critical",
+        "Hidden characters in an agent instruction file",
+        [
+          "contains zero-width / bidi / Unicode-tag characters \u2014 a technique to hide instructions from human review while the agent still reads them"
+        ],
+        "Remove the hidden characters. Instruction files must be plain, reviewable text.",
+        path70
+      )
+    );
+  }
+  const ov = OVERRIDE_RE.exec(content);
+  const ovEnc = !ov ? OVERRIDE_RE.exec(decoded) : null;
+  if (ov || ovEnc) {
+    const m = ov || ovEnc;
+    findings.push(
+      mk(
+        ovEnc ? "critical" : "high",
+        "Prompt-override directive in an agent instruction file",
+        [
+          `contains a prompt-override / role-impersonation directive (\`${m[0].slice(0, 60).trim()}\`)${ovEnc ? " \u2014 concealed in a base64 blob" : ""}`
+        ],
+        "Remove the override text. An instruction file should not tell the agent to ignore its own rules.",
+        path70
+      )
+    );
+  }
+  const fo = FETCH_OBEY_RE.exec(content);
+  if (fo && !inHumanSection(content, fo.index) && !isNegated(content, fo.index)) {
+    findings.push(
+      mk(
+        "medium",
+        "Instruction directs the agent to fetch and run remote code",
+        [`\`${fo[0].slice(0, 70).trim()}\` \u2014 fetch-and-obey, outside an install/setup section`],
+        "Do not instruct the agent to pipe remote content into a shell; pin and vendor scripts instead.",
+        path70
+      )
+    );
+  }
+  const sp = SECRET_PATH_RE.exec(content);
+  if (sp && !isNegated(content, sp.index)) {
+    findings.push(
+      mk(
+        "medium",
+        "Instruction points the agent at credential material",
+        [`references \`${sp[0].slice(0, 50).trim()}\` \u2014 directs the agent toward secrets`],
+        "Do not reference credential files or paths in agent instructions.",
+        path70
+      )
+    );
+  }
+  const ex = EXFIL_RE.exec(content);
+  if (ex && !inHumanSection(content, ex.index) && !isNegated(content, ex.index)) {
+    findings.push(
+      mk(
+        "medium",
+        "Instruction directs the agent to send data to an external endpoint",
+        [`\`${ex[0].slice(0, 70).trim()}\` \u2014 possible exfiltration directive`],
+        "Remove external post/upload directives from agent instructions.",
+        path70
+      )
+    );
+  }
+  return findings;
+}
+
 // src/ci-check/index.ts
 function worstOf(findings) {
   let worst = null;
@@ -53467,10 +53710,16 @@ function scanTree(tree) {
       if (/\.github\/workflows\/.+\.ya?ml$/.test(file.path)) {
         const f = analyzeWorkflow(file.path, file.content);
         if (f) findings.push(f);
+        const s = analyzeWorkflowSecrets(file.path, file.content);
+        if (s) findings.push(s);
       } else if (/\.claude\/settings(\.local)?\.json$/.test(file.path)) {
         findings.push(...analyzeAgentConfig(file.path, file.content));
       } else if (/\.mcp\.json$|\.cursor\/mcp\.json$/.test(file.path)) {
         findings.push(...analyzeMcp(file.path, file.content));
+      } else if (/(^|\/)(CLAUDE|AGENTS|GEMINI)\.md$|(^|\/)\.cursorrules$|copilot-instructions\.md$|(^|\/)\.(windsurf|cline)rules$/.test(
+        file.path
+      )) {
+        findings.push(...analyzeInstructionFile(file.path, file.content));
       }
     } catch (err2) {
       notes.push(`checker degraded on ${file.path}: ${err2?.message ?? "error"}`);
@@ -53501,6 +53750,36 @@ var COLOR = {
   medium: chalk29.yellow,
   advisory: chalk29.gray
 };
+var ACTION_URL = "https://github.com/marketplace/actions/node9-agent-security-check?ref=cli_scan_repo";
+function renderCta(res) {
+  const L = [];
+  L.push(chalk29.dim("   " + "\u2500".repeat(63)));
+  if (res.worst === "critical" || res.worst === "high") {
+    const n = res.findings.filter((f) => f.severity === "critical" || f.severity === "high").length;
+    L.push(
+      "   " + chalk29.red.bold(
+        `\u{1F534} ${n} ${n === 1 ? "issue" : "issues"} to fix \u2014 then stop the next at the PR.`
+      )
+    );
+    L.push("");
+    L.push("   " + chalk29.bold("Catch this class of issue on every PR, automatically:"));
+  } else if (res.worst) {
+    L.push("   " + chalk29.yellow("\u{1F7E1} Review the findings above, then keep it covered:"));
+    L.push("");
+    L.push("   " + chalk29.bold("Check every PR for agent-CI risk:"));
+  } else if (res.incomplete) {
+    L.push("   " + chalk29.yellow.bold("\u26A0\uFE0F  Incomplete \u2014 not a clean bill of health."));
+    L.push("");
+    L.push("   " + chalk29.bold("Get a complete check on every PR (CI reads the tree directly):"));
+  } else {
+    L.push("   " + chalk29.green("\u2705 Agent CI is well-configured \u2014 0 unmitigated issues."));
+    L.push("");
+    L.push("   " + chalk29.bold("Keep it green as you add agent workflows \u2014 check every PR:"));
+  }
+  L.push("   " + chalk29.dim("\u2192 ") + chalk29.cyan.underline(ACTION_URL));
+  L.push("   " + chalk29.gray("  zero setup \xB7 no token \xB7 runs in your CI"));
+  return L;
+}
 function ownedHint(source) {
   return source.startsWith("/") || source.startsWith(".") || source.startsWith("~");
 }
@@ -53545,6 +53824,8 @@ function renderScan(res) {
       )
     );
   }
+  L.push("");
+  L.push(...renderCta(res));
   return L.join("\n");
 }
 function renderScanMarkdown(res) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.58.5",
+  "version": "1.59.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",