Static · read-only · browser direct

Scan Agent Skills and repository instructions before your coding agent reads them.

Find every SKILL.md plus AGENTS.md, CLAUDE.md, Cursor, Copilot, Gemini, and Windsurf rules across a public repository. Review hidden Unicode, remote execution, secret handling, destructive commands, and safety bypasses without running any repository code.

risk signals

file cap

commands run

Deterministic early-warning checks can miss malicious intent and can flag legitimate maintenance commands. Every match requires human review.

Free GitHub Action

Review every instruction change in CI.

Add the same eight deterministic checks to pull requests. The zero-dependency action adds line annotations, a job summary, and a JSON plus SARIF report without a token, network call, or telemetry.

View source

.github/workflows/agent-instruction-security.ymlfail on high

name: Agent instruction security

on:
  pull_request:

permissions:
  contents: read

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: sunxiayi/repo-agent-instruction-security-scan@v1

Free local CLI

Scan before your coding agent opens the repository.

Install the provenance-backed v1.2.0 release with Homebrew on macOS or Linux, Scoop on Windows, or run the exact release asset with Node.js. None of these paths needs an account or token, and the scanner executes none of the instruction content it reads.

Download .tar.gz View v1.2.0

Text

Readable line findings

JSON

Machine-readable evidence

SARIF

Code-scanning compatible

Homebrew · macOS and Linuxv1.2.0

brew install sunxiayi/tap/repo-agent-scan
repo-agent-scan .

Windows · Scoop

scoop bucket add repoagentkit https://github.com/sunxiayi/scoop-bucket
scoop install repoagentkit/repo-agent-scan
repo-agent-scan .

Node.js 20+ fallback

npx --yes https://github.com/sunxiayi/repo-agent-instruction-security-scan/releases/download/v1.2.0/repo-agent-instruction-security-scan-1.2.0.tar.gz .

SARIF for code scanning

repo-agent-scan . --fail-on medium --format sarif --output agent-instructions.sarif

Validated pre-commit hook

repos:
  - repo: https://github.com/sunxiayi/repo-agent-instruction-security-scan
    rev: v1.2.0
    hooks:
      - id: repo-agent-instruction-security-scan

CI validates the manifest and installs this immutable release in isolated macOS, Linux, and Windows paths. GitHub also signs build provenance for the exact archive.

Versioned package · 9.1 KB

Verify before installing:

SHA-256 d47c96668525357f60d0b9528118bc668f8eaabf7e2fd0fe87809536115851dagh attestation verify repo-agent-instruction-security-scan-1.2.0.tar.gz -R sunxiayi/repo-agent-instruction-security-scan

Threat boundary

Instruction files are privileged context, not ordinary docs.

Coding agents can execute commands, read files, and call external services. Instructions embedded in repository content can influence those actions, so static review should happen before trust—not after execution.

Read the secure deployment guidance

Review what humans miss

Render invisible and bidirectional controls as explicit code points.

Keep secrets bounded

Flag instructions that pair sensitive material with outbound transfer or broad access.

Preserve approval

Surface commands and language that weaken sandbox, confirmation, or review boundaries.

What the result means

A match is a focused review prompt, not proof of malicious intent. Install scripts, maintenance commands, and credential guidance can be legitimate when they are narrow and independently reviewed.

A clean result is not a security guarantee. Static patterns cannot establish provenance, detect every indirect instruction, or prove that runtime permissions and network controls are safe.