node9-ai 2.10.0 → 2.12.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +13 -7
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -97,13 +97,13 @@ node9 scan-repo <owner/repo> --json # machine-readable
|
|
|
97
97
|
|
|
98
98
|
What it checks:
|
|
99
99
|
|
|
100
|
-
| Check | Flags
|
|
101
|
-
| -------- |
|
|
102
|
-
| **CI-1** | committed agent config that pre-authorizes broad tools or runs remote hooks
|
|
103
|
-
| **CI-2** | injectable agent workflows — an outsider can trigger the agent and hijack it
|
|
104
|
-
| **CI-3** | unpinned / `@latest` MCP servers or inline credentials (supply chain)
|
|
105
|
-
| **CI-4** | secrets an injected agent could exfiltrate
|
|
106
|
-
| **CI-6** | poisoned or dangerous instructions in `CLAUDE.md` / `AGENTS.md` /
|
|
100
|
+
| Check | Flags |
|
|
101
|
+
| -------- | -------------------------------------------------------------------------------- |
|
|
102
|
+
| **CI-1** | committed agent config that pre-authorizes broad tools or runs remote hooks |
|
|
103
|
+
| **CI-2** | injectable agent workflows — an outsider can trigger the agent and hijack it |
|
|
104
|
+
| **CI-3** | unpinned / `@latest` MCP servers or inline credentials (supply chain) |
|
|
105
|
+
| **CI-4** | secrets an injected agent could exfiltrate |
|
|
106
|
+
| **CI-6** | poisoned or dangerous instructions in `CLAUDE.md` / `AGENTS.md` / `.cursorrules` |
|
|
107
107
|
|
|
108
108
|
**Gate every PR** — the same engine as a GitHub Action, so a hijackable config can't get merged:
|
|
109
109
|
|
|
@@ -112,8 +112,14 @@ What it checks:
|
|
|
112
112
|
- uses: node9-ai/node9-proxy@v2
|
|
113
113
|
with:
|
|
114
114
|
fail-on: high # or 'never' to just comment
|
|
115
|
+
fail-on-scope: introduced # only what THIS PR added; 'all' (default) judges the whole repo
|
|
115
116
|
```
|
|
116
117
|
|
|
118
|
+
`fail-on-scope: introduced` is what makes the gate adoptable on a repository that already
|
|
119
|
+
has findings: the PR comment leads with what the change introduced, pre-existing findings
|
|
120
|
+
stay listed but do not block, and a base commit that cannot be read falls back to judging
|
|
121
|
+
everything rather than passing.
|
|
122
|
+
|
|
117
123
|
Marketplace: **[node9 Agent Security](https://github.com/marketplace/actions/node9-agent-security)**
|
|
118
124
|
|
|
119
125
|
Running it? Add the **[`scanned by node9` badge](docs/badges.md)** to your README.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "node9-ai",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.12.0",
|
|
4
4
|
"description": "Security layer for AI coding agents — intercepts dangerous tool calls before they execute",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"ai",
|
|
@@ -25,7 +25,7 @@
|
|
|
25
25
|
"node9-ai": "bin/node9.js"
|
|
26
26
|
},
|
|
27
27
|
"dependencies": {
|
|
28
|
-
"@node9/proxy": "2.
|
|
28
|
+
"@node9/proxy": "2.12.0"
|
|
29
29
|
},
|
|
30
30
|
"type": "module",
|
|
31
31
|
"engines": {
|