agentpipe-scan 0.5.0__tar.gz

agentpipe_scan-0.5.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Agentoffense
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

agentpipe_scan-0.5.0/PKG-INFO

@@ -0,0 +1,126 @@
+Metadata-Version: 2.4
+Name: agentpipe-scan
+Version: 0.5.0
+Summary: Find CI agents that eat untrusted GitHub events and hold secrets
+Author: Agentpipe
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/cyberbobas/agentpipe
+Project-URL: Issues, https://github.com/cyberbobas/agentpipe/issues
+Keywords: ai-agent,github-actions,prompt-injection,ci,security,clinejection,supply-chain,sast,agent-security
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Topic :: Security
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: PyYAML>=6.0
+Dynamic: license-file
+
+# agentpipe
+
+[![PyPI](https://img.shields.io/pypi/v/agentpipe-scan?color=8b7cf6)](https://pypi.org/project/agentpipe-scan/)
+[![tests](https://github.com/cyberbobas/agentpipe/actions/workflows/tests.yml/badge.svg)](https://github.com/cyberbobas/agentpipe/actions/workflows/tests.yml)
+[![Python](https://img.shields.io/pypi/pyversions/agentpipe-scan)](https://pypi.org/project/agentpipe-scan/)
+[![License](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
+
+Find **CI agents that eat untrusted GitHub events and hold keys**. A repo lets a
+stranger's issue title drive an AI agent step that carries an npm token, and now
+an issue is a publish. agentpipe finds those chains statically, before anyone
+opens the issue.
+
+Not an Actions linter. Not gitleaks. It reports preconditions and never exploits.
+
+![agentpipe finds an untrusted issue -> AI agent -> npm token publish chain](docs/agentpipe-scan.gif)
+
+Part of [Agentoffense](https://agentoffense.com). The recon front of the line:
+find the exposure here, close it at runtime with
+[Airlock](https://github.com/cyberbobas/airlock) and
+[Countersign](https://github.com/cyberbobas/countersign).
+
+```
+pip install agentpipe-scan
+agentpipe scan .                          # local clone, no network
+agentpipe scan github.com/org/repo        # public workflows via GitHub API
+agentpipe scan github.com/org             # whole org, aggregated report
+agentpipe prove .                         # canary kit: prove each finding harmlessly
+                                          # (token: GITHUB_TOKEN env or --token)
+```
+
+## The killer bit: `prove`
+
+A finding says "preconditions exist". `agentpipe prove` turns each high/medium
+finding into a **harmless canary kit**: a unique token, the exact issue/PR text
+to paste into a fork you own, the three places to watch (comment, step summary,
+job log), what a positive result proves — and what it still doesn't (that part
+is the pentest). Every payload is echo/read-only by construction.
+
+The report also groups flat findings into **attack chains**
+(entry → amplify → impact, one per job, severity-tagged).
+
+## `agentpipe local` — the laptop half
+
+CI is only half the surface. `agentpipe local` audits agent configs on the
+machine itself (`~/.claude.json`, `.mcp.json`, cursor/gemini/windsurf configs):
+
+| id | finding |
+|---|---|
+| LOC-01 | confirmations weakened/off (`bypassPermissions`, unscoped tool grants) |
+| LOC-02 | MCP server via unpinned `npx -y pkg` (rug-pull channel) |
+| LOC-03 | filesystem MCP rooted at `/` or `~` |
+| LOC-04 | remote MCP over plaintext `http://` or with no auth header |
+| LOC-05 | hook piping the network into a shell (`curl … \| sh`) |
+| LOC-06 | plaintext credential in an MCP env block (values are masked in the report) |
+| LOC-07 | CLAUDE.md/.cursorrules ordering the agent to never ask |
+
+Read-only, no network, secret values never printed.
+
+Clinejection-class demo (issue title → Claude in Actions → npm token):
+
+```
+agentpipe scan examples/clinejection-repo
+```
+
+## What the scanner flags
+
+| id | chain | since |
+|---|---|---|
+| AWI-01 | untrusted trigger (`issues`, `issue_comment`, `pull_request_target`, …) + agent step + secret/write/publish | 0.1 |
+| AWI-02 | `${{ github.event.issue.title }}` (or body/comment/PR) interpolated into the agent step | 0.1 |
+| AWI-03 | `pull_request_target` + agent + checkout of PR head | 0.1 |
+| AWI-04 | agent job can `issues: write` / `gh issue comment` (GitLost exfil) | 0.1 |
+| AWI-05 | `--dangerously-skip-permissions` / YOLO on that agent | 0.1 |
+| AWI-06 | `actions/cache` written on an untrusted-trigger workflow next to an agent/release | 0.3 |
+| AWI-07 | agent/release job downloads artifacts across workflow boundaries (`workflow_run`) | 0.3 |
+| AWI-08 | agent + `gh` CLI + `contents`/`actions: write` (workflow persistence) | 0.2 |
+| AWI-09 | OIDC / cloud login on the untrusted-prompt job | 0.2 |
+| AWI-10 | agent + untrusted trigger on a self-hosted runner | 0.2 |
+| AWI-11 | agent hidden in a local composite action or reusable workflow (recursed, caller triggers inherited) | 0.2 |
+| AWI-12 | GitHub Agentic Workflows: markdown `engine:` + untrusted `on:` + write surface | 0.3 |
+| AWI-13 | Dependabot/Renovate in repo + agent merges PRs with no `dependabot[bot]` actor guard | 0.3 |
+| AWI-14 | publish after/alongside an agent job with no `environment:` gate | 0.2 |
+| AWI-15 | agent step handed `mcp_config` / MCP servers (CI trifecta) | 0.3 |
+
+Findings carry real `file:line` of the agent step. A workflow that does not parse is a loud warning, not a silent skip.
+
+Not yet: INS-01..04 (instruction-file hygiene in repos), GitHub Action wrapper, `--follow-remote`.
+
+## What you will not see
+
+A 0–100 score. A badge. Telemetry. A working exploit. An Airlock pitch.
+
+The report ends with **what this scan cannot see** — that list *is* the pentest offer.
+
+## Verdicts
+
+`reachable` (trigger + agent + sink) · `plausible` (untrusted field in the prompt) · `adjacent` (one piece of the chain). Severity only on the first two.
+
+MIT. Python ≥ 3.11. PyYAML.
+
+```
+python3 tests/run.py           # regression suite (41 checks)
+python3 tests/adversarial.py   # parser fuzz, FP/FN matrix, recursion, ReDoS, CLI
+python3 tests/matrix.py         # negative matrix per detector, GitHub semantics, live corpus
+```

agentpipe_scan-0.5.0/README.md

@@ -0,0 +1,105 @@
+# agentpipe
+
+[![PyPI](https://img.shields.io/pypi/v/agentpipe-scan?color=8b7cf6)](https://pypi.org/project/agentpipe-scan/)
+[![tests](https://github.com/cyberbobas/agentpipe/actions/workflows/tests.yml/badge.svg)](https://github.com/cyberbobas/agentpipe/actions/workflows/tests.yml)
+[![Python](https://img.shields.io/pypi/pyversions/agentpipe-scan)](https://pypi.org/project/agentpipe-scan/)
+[![License](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
+
+Find **CI agents that eat untrusted GitHub events and hold keys**. A repo lets a
+stranger's issue title drive an AI agent step that carries an npm token, and now
+an issue is a publish. agentpipe finds those chains statically, before anyone
+opens the issue.
+
+Not an Actions linter. Not gitleaks. It reports preconditions and never exploits.
+
+![agentpipe finds an untrusted issue -> AI agent -> npm token publish chain](docs/agentpipe-scan.gif)
+
+Part of [Agentoffense](https://agentoffense.com). The recon front of the line:
+find the exposure here, close it at runtime with
+[Airlock](https://github.com/cyberbobas/airlock) and
+[Countersign](https://github.com/cyberbobas/countersign).
+
+```
+pip install agentpipe-scan
+agentpipe scan .                          # local clone, no network
+agentpipe scan github.com/org/repo        # public workflows via GitHub API
+agentpipe scan github.com/org             # whole org, aggregated report
+agentpipe prove .                         # canary kit: prove each finding harmlessly
+                                          # (token: GITHUB_TOKEN env or --token)
+```
+
+## The killer bit: `prove`
+
+A finding says "preconditions exist". `agentpipe prove` turns each high/medium
+finding into a **harmless canary kit**: a unique token, the exact issue/PR text
+to paste into a fork you own, the three places to watch (comment, step summary,
+job log), what a positive result proves — and what it still doesn't (that part
+is the pentest). Every payload is echo/read-only by construction.
+
+The report also groups flat findings into **attack chains**
+(entry → amplify → impact, one per job, severity-tagged).
+
+## `agentpipe local` — the laptop half
+
+CI is only half the surface. `agentpipe local` audits agent configs on the
+machine itself (`~/.claude.json`, `.mcp.json`, cursor/gemini/windsurf configs):
+
+| id | finding |
+|---|---|
+| LOC-01 | confirmations weakened/off (`bypassPermissions`, unscoped tool grants) |
+| LOC-02 | MCP server via unpinned `npx -y pkg` (rug-pull channel) |
+| LOC-03 | filesystem MCP rooted at `/` or `~` |
+| LOC-04 | remote MCP over plaintext `http://` or with no auth header |
+| LOC-05 | hook piping the network into a shell (`curl … \| sh`) |
+| LOC-06 | plaintext credential in an MCP env block (values are masked in the report) |
+| LOC-07 | CLAUDE.md/.cursorrules ordering the agent to never ask |
+
+Read-only, no network, secret values never printed.
+
+Clinejection-class demo (issue title → Claude in Actions → npm token):
+
+```
+agentpipe scan examples/clinejection-repo
+```
+
+## What the scanner flags
+
+| id | chain | since |
+|---|---|---|
+| AWI-01 | untrusted trigger (`issues`, `issue_comment`, `pull_request_target`, …) + agent step + secret/write/publish | 0.1 |
+| AWI-02 | `${{ github.event.issue.title }}` (or body/comment/PR) interpolated into the agent step | 0.1 |
+| AWI-03 | `pull_request_target` + agent + checkout of PR head | 0.1 |
+| AWI-04 | agent job can `issues: write` / `gh issue comment` (GitLost exfil) | 0.1 |
+| AWI-05 | `--dangerously-skip-permissions` / YOLO on that agent | 0.1 |
+| AWI-06 | `actions/cache` written on an untrusted-trigger workflow next to an agent/release | 0.3 |
+| AWI-07 | agent/release job downloads artifacts across workflow boundaries (`workflow_run`) | 0.3 |
+| AWI-08 | agent + `gh` CLI + `contents`/`actions: write` (workflow persistence) | 0.2 |
+| AWI-09 | OIDC / cloud login on the untrusted-prompt job | 0.2 |
+| AWI-10 | agent + untrusted trigger on a self-hosted runner | 0.2 |
+| AWI-11 | agent hidden in a local composite action or reusable workflow (recursed, caller triggers inherited) | 0.2 |
+| AWI-12 | GitHub Agentic Workflows: markdown `engine:` + untrusted `on:` + write surface | 0.3 |
+| AWI-13 | Dependabot/Renovate in repo + agent merges PRs with no `dependabot[bot]` actor guard | 0.3 |
+| AWI-14 | publish after/alongside an agent job with no `environment:` gate | 0.2 |
+| AWI-15 | agent step handed `mcp_config` / MCP servers (CI trifecta) | 0.3 |
+
+Findings carry real `file:line` of the agent step. A workflow that does not parse is a loud warning, not a silent skip.
+
+Not yet: INS-01..04 (instruction-file hygiene in repos), GitHub Action wrapper, `--follow-remote`.
+
+## What you will not see
+
+A 0–100 score. A badge. Telemetry. A working exploit. An Airlock pitch.
+
+The report ends with **what this scan cannot see** — that list *is* the pentest offer.
+
+## Verdicts
+
+`reachable` (trigger + agent + sink) · `plausible` (untrusted field in the prompt) · `adjacent` (one piece of the chain). Severity only on the first two.
+
+MIT. Python ≥ 3.11. PyYAML.
+
+```
+python3 tests/run.py           # regression suite (41 checks)
+python3 tests/adversarial.py   # parser fuzz, FP/FN matrix, recursion, ReDoS, CLI
+python3 tests/matrix.py         # negative matrix per detector, GitHub semantics, live corpus
+```

agentpipe_scan-0.5.0/agentpipe/__init__.py

@@ -0,0 +1,11 @@
+"""agentpipe — scan agentic CI for untrusted-text -> agent -> secret chains."""
+# Single source of truth is pyproject; read from installed metadata so
+# `agentpipe --version` never drifts from the released package.
+try:
+    from importlib.metadata import PackageNotFoundError, version as _v
+    try:
+        __version__ = _v("agentpipe-scan")
+    except PackageNotFoundError:
+        __version__ = "0.0.0+source"
+except Exception:  # pragma: no cover
+    __version__ = "0.0.0+source"

agentpipe_scan-0.5.0/agentpipe/cli.py

@@ -0,0 +1,164 @@
+"""agentpipe — untrusted GitHub text → CI agent → secret/write."""
+from __future__ import annotations
+import argparse
+import json
+import sys
+from pathlib import Path
+
+from . import __version__
+from . import prove, remote, local
+from .detect import scan_tree
+from .report import render
+
+
+def _resolve(target: str, token: str | None) -> tuple[Path, str] | None:
+    """Local path or remote repo → (root, label). Prints errors, None on fail."""
+    if remote.is_remote_target(target):
+        try:
+            root, ref = remote.fetch_repo(target, token=token)
+        except remote.RemoteError as e:
+            print(f"agentpipe: {e}", file=sys.stderr)
+            return None
+        print(f"agentpipe: remote scan {ref} — public files only", file=sys.stderr)
+        return root, target
+    root = Path(target)
+    if not root.exists():
+        print(f"agentpipe: {root} not found "
+              f"(for remote: agentpipe scan github.com/owner/repo)", file=sys.stderr)
+        return None
+    return root, target
+
+
+def _scan_one(root: Path) -> tuple[list, list[str]]:
+    errors: list[str] = []
+    findings = scan_tree(root, errors=errors)
+    for e in errors:
+        print(f"agentpipe: warning: {e}", file=sys.stderr)
+    return findings, errors
+
+
+def _fail_code(findings, fail_on: str) -> int:
+    highs = any(f.severity == "high" for f in findings)
+    meds = any(f.severity == "medium" for f in findings)
+    if fail_on == "high" and highs:
+        return 1
+    if fail_on == "medium" and (highs or meds):
+        return 1
+    return 0
+
+
+def _scan_org(target: str, token: str | None, max_repos: int,
+              json_out: bool) -> int:
+    org = remote.org_name(target)
+    try:
+        repos = remote.list_org_repos(org, token=token, max_repos=max_repos)
+    except remote.RemoteError as e:
+        print(f"agentpipe: {e}", file=sys.stderr)
+        return 2
+    print(f"agentpipe: org {org} — {len(repos)} public repos queued",
+          file=sys.stderr)
+    agg: dict[str, list] = {}
+    any_high = False
+    for full in repos:
+        try:
+            root, ref = remote.fetch_repo(f"github.com/{full}", token=token)
+        except remote.RemoteError as e:
+            print(f"agentpipe: {full}: {e}", file=sys.stderr)
+            continue
+        findings, _err = _scan_one(root)
+        agg[full] = findings
+        sev = [f for f in findings if f.severity]
+        if sev:
+            h = sum(1 for f in sev if f.severity == "high")
+            m = sum(1 for f in sev if f.severity == "medium")
+            any_high = any_high or h > 0
+            print(f"  {full}: {h} high {m} medium "
+                  f"({', '.join(sorted({f.id for f in sev}))})", file=sys.stderr)
+    if json_out:
+        print(json.dumps({r: [f.to_dict() for f in fs] for r, fs in agg.items()},
+                         indent=2))
+    else:
+        print(f"\n== {org} org scan ==")
+        for full, fs in agg.items():
+            sev = [f for f in fs if f.severity]
+            if not sev:
+                continue
+            print(f"\n### {full}")
+            print(render(sev + [f for f in fs if not f.severity]))
+    return 1 if any_high else 0
+
+
+def main(argv: list[str] | None = None) -> int:
+    p = argparse.ArgumentParser(
+        prog="agentpipe",
+        description="Find CI agents that eat untrusted GitHub events and hold keys.")
+    p.add_argument("--version", action="version", version=f"agentpipe {__version__}")
+    sub = p.add_subparsers(dest="cmd")
+    sc = sub.add_parser("scan", help="scan a repo, github.com/owner/repo or github.com/org")
+    sc.add_argument("path", nargs="?", default=".")
+    sc.add_argument("--json", action="store_true")
+    sc.add_argument("--token", default=None,
+                    help="GitHub token for remote scan (or GITHUB_TOKEN/GH_TOKEN env)")
+    sc.add_argument("--max-repos", type=int, default=50,
+                    help="org scan: cap on repos fetched")
+    sc.add_argument("--fail-on", default="high",
+                    choices=["never", "high", "medium"],
+                    help="exit 1 if findings at this severity exist")
+    pv = sub.add_parser("prove", help="generate a harmless canary kit for each finding")
+    pv.add_argument("path", nargs="?", default=".")
+    pv.add_argument("--token", default=None)
+    pv.add_argument("--json", action="store_true")
+    lc = sub.add_parser("local", help="audit agent configs on this machine (MCP, permissions, hooks)")
+    lc.add_argument("--root", default=None,
+                    help="home dir to audit (default: your $HOME)")
+    lc.add_argument("--cwd", default=".",
+                    help="project dir to audit (default: .)")
+    lc.add_argument("--json", action="store_true")
+    args = p.parse_args(sys.argv[1:] if argv is None else argv)
+    if args.cmd not in ("scan", "prove", "local"):
+        p.print_help()
+        return 2
+
+    if args.cmd == "local":
+        root = Path(args.root).expanduser() if args.root else Path.home()
+        cwd = Path(args.cwd).resolve()
+        errors: list[str] = []
+        findings = local.scan_local(root, cwd, errors=errors)
+        for e in errors:
+            print(f"agentpipe: warning: {e}", file=sys.stderr)
+        if args.json:
+            print(json.dumps([f.to_dict() for f in findings], indent=2))
+        else:
+            print(render(findings))
+        return _fail_code(findings, "high")
+
+    if args.cmd == "prove":
+        r = _resolve(args.path, args.token)
+        if r is None:
+            return 2
+        root, label = r
+        findings, _ = _scan_one(root)
+        if args.json:
+            print(json.dumps([prove.build(f) for f in findings
+                              if f.severity in ("high", "medium")], indent=2))
+        else:
+            print(prove.render_kit(findings, label))
+        return 0
+
+    if remote.is_org_target(args.path) and not remote.is_remote_target(args.path):
+        return _scan_org(args.path, args.token, args.max_repos, args.json)
+
+    r = _resolve(args.path, args.token)
+    if r is None:
+        return 2
+    root, _label = r
+    findings, _ = _scan_one(root)
+    if args.json:
+        print(json.dumps([f.to_dict() for f in findings], indent=2))
+    else:
+        print(render(findings))
+    return _fail_code(findings, args.fail_on)
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())