CI gate for AI coding agent supply-chain attacks

ShadowAgent Guard

Your AI coding agent obeys files in the repo. Attackers can write those files.

One pull request can slip in a hallucinated package, an invisible instruction in AGENTS.md, an auto-approved shell tool, or a deleted test. ShadowAgent Guard diffs every PR, grades it A to F and blocks the merge before an agent or a developer runs any of it.

- uses: Ahmadbey678/ShadowAgent-Guard@main
View on GitHub Demo PR: blocked Demo PR: remediated
Showing report
-
-

Hidden-Unicode rules injection

What humans see vs. what the agent sees

The same AGENTS.md from the demo pull request. Unicode tag characters render as nothing in GitHub's diff view and in editors, but the model reads them as plain text.

As rendered to humanslooks innocent

        

        

          
Decoded, as seen by the agenthidden instruction

          

        

      

      

    


    
    

      
Same PR, before and after remediation

      
From BLOCK to PASS

      
Both reports below are real report.json files produced by scanning the demo repository's ai-pr and ai-pr-remediated branches. Remediation used IBM Bob's hardened agent configs plus manual fixes for the dependencies and tests. The tool reports those two categories; it does not fix them automatically.

      

      

    


    
    

      
Hardening, generated by IBM Bob

      
Risky config vs. hardened config

      
The shadowagent-guard Bob mode can only write to guard-out/, so it proposes hardened files rather than editing the target repo. A human applies them.

      

      

      

    


    
    

      
How it works

      
From pull request to merge gate

      

        
          ShadowAgent Guard pipeline
          A pull request goes to the IBM Bob ShadowAgent Guard mode, which runs three parallel subagents (dependencies, agent config, tests). Their findings are merged into a verdict, Bob writes hardened files, and the CI gate blocks or passes the merge.
          
            
          
          
            
            
            
            
            
            
            
            
            
            
          
          
            
            Pull requestbase..head

            
            IBM Bob
            shadowagent-guard mode
            /guard · skill · rules

            
            depsPyPI · npm · install scripts
            
            agent-configUnicode · injection · MCP
            
            testsdeleted · skipped · weakened
            3 parallel subagents

            
            Mergereport.json

            
            BLOCK
            or PASS
            grade A to F

            
            CI gateAction · SARIF · summary

            
            Hardenguard-out/hardened/
          
          Everything read from the scanned repo is untrusted data. Bob reports injected instructions and never follows them.
        
      

    


    
    

      
Findings

      
Findings

      

        

          

          
          
          
          
        

        

      

      

      

    


    
    

      
Threat model

      
How each attack works

      

    


    
    

      
Measured on the demo repo

      
Impact

      

      

        

          Detection of each planted issue
          
Planted issueFileRuleCaught

          
        

      

    


    
    

      
Your own scan

      
Load a report.json

      

        
        
        
or drag and drop it anywhere on this page.

        
Privacy: Reports are rendered in your browser and never uploaded.