AST DATAFLOW GUARD FOR GITHUB ACTIONS

Catch Prompt-Injection & P2S Paths in Autonomous GitHub CI Agents.

Moving github.event.* into an env: variable clears shell-injection linters while leaving AI prompts vulnerable. AgentFence traces untrusted payloads across expressions, step outputs, and .mcp.json configs before agent runs execute.

Run Instant Local Security Audit zero network egress

$ npx agentfence-cli --format text .

Also available under TensorJetAI scope: npx @tensorjetai/agentfence --format text .

Run npx agentfence-cli Explore Rules (AF001–AF007) →

100% Static AST

Deterministic taint, zero LLM guesses

Runner-Local

Zero source leaves your runner

SARIF 2.1.0

GitHub Code Scanning native

PR Check Run #1042: AST Taint Trace

target: .github/workflows/claude-env-intermediary.yml @ commit 98f3b0e

CRITICAL SINK DETECTED

// Actions Workflow AST Lexer CodeQL & zizmor: 0 alerts | AgentFence: tainted sink

Deterministic 3-Hop Taint Graph Trace

Deterministic AST

Hop 1: Source UNTRUSTED

github.event.comment.body

Unvetted issue comment assigned to env.ISSUE_BODY to pass shell-injection linters.

Hop 2: Flow ENV TAINT

env.ISSUE_BODY → prompt

AST taint tracking follows tainted env bindings into anthropics/claude-code-action.

Hop 3: Sink WRITE SCOPE

contents: write + non-write users

Agent runs with repository write permissions on open contributor input.

CHECK FAILED BLOCKED: AF001 Untrusted Input Reaches Privileged Agent

Agent step gated before invocation

Why Standard SAST and CI Linters Miss Agentic Workflow Injections

AgentFence complements zizmor, actionlint, and CodeQL. Generic CI linters check shell quoting—so moving issue.body into an intermediate env: clears their alerts while leaving the AI prompt and P2S shell sinks exposed.

AF001 Critical

Untrusted Prompt Taint

An external contributor submits an issue or PR body. Even when passed via env: or reusable inputs, tainted text reaches privileged AI agent prompts.

AST Rule: Untrusted event data reaches privileged agent prompt.

AF002 Critical

Prompt-to-Script (P2S)

Unvalidated agent output is interpolated directly into a runner shell step (run: gh ... "${{ steps.gemini.outputs.summary }}") without structured allowlisting.

AST Rule: Recognized agent output reaches shell execution.

AF003 Critical

Privileged Fork Checkout

Workflows triggered by pull_request_target checking out contributor head.sha inside a job carrying write scopes or secrets.

AST Rule: Contributor checkout enters privileged job.

AF006 & AF007 Critical / High

Secret Exposure & MCP Configs

Secrets exposed where untrusted data influences an agent (AF006), or .mcp.json / settings running unpinned npx servers (AF007).

AST Rule: Secret flow isolation + MCP config hygiene.

Deterministic AST Parsing — 100% Runner-Local Execution

No probabilistic LLM scanner watching your LLM. AgentFence is pure deterministic static analysis running inside your local terminal or CI runner—zero workflow files or prompts leave your environment.

YAML, gh-aw & MCP Parsing

Parses GitHub Actions (.github/workflows/*.yml), Agentic Workflows (gh-aw), and .mcp.json configs without executing any code.

Symbolic Taint Graph

Traces untrusted event sources (issue.body, comment.body) across env:, reusable workflows, composite actions, and step outputs.

Capability & Gate Policy

Evaluates trust predicates, job permissions, secrets exposure, and allowed agent tools (Bash, Edit, write scopes) per provider profile.

Runner-Local SARIF & Gate

Executes completely offline in your terminal or GitHub runner with zero network calls, emitting SARIF 2.1.0, JSON, or human-readable traces.

Modeled Agent Actions & Configuration Surfaces

Provider-aware taint rules across all six major GitHub agent workflows plus MCP configs.

6 Providers + MCP

claude-code-action & base-action

Interactive & explicit prompts, env taint, and claude_args / tool boundaries

Status: Complete AF001–AF006

github/gh-aw (Agentic)

Markdown agent frontmatter & declared shell tool boundary analysis

Status: Complete AF001–AF006

codex / gemini-cli / ai-inference

Prompt injection, P2S shell output sinks, secret isolation & trigger checks

Status: Complete AF001–AF006

MCP & IDE Agent Settings

Checks .mcp.json, .claude/settings.json, and .gemini/settings.json safely

Status: AF007 Shipped

Exhaustive Agent CI Guardrail Catalog (AF001–AF007)

Every rule in AgentFence corresponds to an audited source-to-sink vulnerability condition in workflow ASTs. All rules can be suppressed with reviewed justification using inline comments.

Rule ID	Severity	Vulnerability Vector	AST Trigger Condition	Default CI Action
AF001	Critical	Untrusted Prompt Injection Sink Untrusted event/repo data reaches privileged agent prompt (directly or via env:/outputs).	`github.event.*` → `env / prompt` + `privileged action`	Blocks (Exit 1)
AF002	Critical	Prompt-to-Script (P2S) Recognized agent output reaches shell execution without structured allowlisting.	`steps.agent.outputs.*` → `run: bash/sh`	Blocks (Exit 1)
AF003	Critical	Fork Checkout in Privileged Job Contributor-controlled checkout enters a privileged pull_request_target job.	`pull_request_target` + `checkout head.sha`	Blocks (Exit 1)
AF004	High	Unvetted Public Agent Trigger Public trigger starts agent without actor, label, approval, or environment gate.	`on: [issues, comments]` without `trust gate`	CLI Fails / Hosted Warns
AF005	High	Broad Write Permissions Agent job receives broad write permissions instead of minimal read scopes.	`permissions: write-all / contents: write`	CLI Fails / Diff Emitted
AF006	Critical	Secret in Untrusted Agent Stage Secret is available where untrusted data influences agent behavior.	`secrets.*` exposed to agent with tainted flow	Blocks (Exit 1)
AF007	Med / High	Risky MCP / Settings Config .mcp.json / .claude / .gemini runs unpinned npx/uvx or broad tool approvals.	`.mcp.json` unpinned package or wildcard approval	CLI Fails / Pin Config

PRO-TIP: Inline YAML Exception Syntax:


                # agentfence-ignore: AF001 -- reviewed input boundary

Audited in SARIF export & PR annotations

Runner-Local CLI. Predictable Commercial Licensing.

Audit workflows locally with our free Apache-2.0 CLI and GitHub Action. Upgrade via Paddle to unlock offline baseline regression diffing, SHA-256 attestations, and governance reports inside the commercial Docker runner.

License delivery email I agree to the Terms of Service and acknowledge the Privacy Policy and Refund Policy.

Community Open Core CLI

Apache 2.0 Linter

For individual developers and open source maintainers auditing workflow YAML and MCP configs in local runs or GitHub Actions.

$0 / forever open source

✔ Complete AF001–AF007 static AST rules

✔ 100% runner-local CLI & GitHub Action

✔ SARIF 2.1.0 & JSON output

✔ Inline YAML & .agentfence.yml policy

Use Apache-2.0 CLI

Self-Serve CI Gate

Pro Tier Commercial Docker CLI

Pro CI Gate

Adopt strict PR blocking today without fixing legacy workflows first: offline-verified baseline diffing and SHA-256 attestations on your own runner.

$89 / month

✔ Offline tj_lic_ license key via Paddle ($790/yr billed annually)

✔ Everything in Community CLI + SARIF

✔ Baseline regression gating (--baseline: block new only)

✔ SHA-256 attestation JSON (--attest)

✔ Zero-egress Docker runner (tj_lic_ offline verify)

Organization Governance & Evidence

Team Governance

For security and platform teams standardizing audit-ready Markdown governance reports and baseline gating across repositories.

$199 / month

✔ Save 2 months on annual billing ($1,990/yr)

✔ Everything in Pro CI Gate

✔ Markdown governance reports (--format markdown)

✔ Point-in-time conformance evidence bundles

✔ Paddle B2B tax/VAT invoices + 14-day refund guarantee

Live checkout calls TensorJet central Paddle billing (tensorjetai.com/api/billing/checkout) with signed billingRef verification and emails an offline Ed25519 tj_lic_ key (AGENTFENCE_LICENSE_KEY).

100% self-serve licensing with async email support — no mandatory sales calls, no cloud repo access, and no source upload. Building an AppSec or CI platform? Email security@tensorjetai.com for OEM embedding.

Add AgentFence to Your Workflow

Start free with the Apache-2.0 CLI & GitHub Action, or run the commercial Docker image in CI with an offline-verified TensorJet license key.

terminal: free CLI + commercial container

Node 22+ / Docker

// 1. Free Apache-2.0 runner-local scan (text & SARIF 2.1.0)

$ npx agentfence-cli --format text .
$ npx agentfence-cli --format sarif . > agentfence.sarif
# Or scoped package: npx @tensorjetai/agentfence --format text .

// 2. Pro / Team offline-verified commercial container (baselines & SHA-256 attestations)

$ echo "$AGENTFENCE_LICENSE_KEY" | docker login registry.tensorjetai.com -u license --password-stdin
$ docker run --rm -v "$PWD:/work" -w /work \
  -e AGENTFENCE_LICENSE_KEY="tj_lic_..." \
  registry.tensorjetai.com/agentfence-commercial:0.1.2 \
  scan .github/workflows --baseline .agentfence-baseline.json --attest .agentfence-attest.json

Offline Ed25519 License Verification — Zero Egress in CI

Checkout via TensorJet billing issues a signed tj_lic_ token verified offline inside the container using TensorJet's pinned Ed25519 public key. No telemetry, no external license server callbacks, and zero source-code upload.

Runner-Local Guarantee: Commercial container scans mounted workspace files locally and emits tj_lic_ status exit codes cleanly for CI gates.