Add Trustabl Agent Scanner to CI - #275
Conversation
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
🤖 My Senior Dev — Analysis Complete👤 For @joshua-trustabl📁 Expert in View your contributor analytics → 📊 1 file reviewed • 1 high risk • 2 need attention 🚨 High Risk:
🚀 Open Interactive Review →The full interface unlocks features not available in GitHub:
💬 Chat here: 📖 View all 12 personas & slash commandsYou can interact with me by mentioning In PR comments or on any line of code:
Slash commands:
AI Personas (mention to get their perspective):
For the best experience, view this PR on myseniordev.com — includes AI chat, file annotations, and interactive reviews. |
codeant-ai
Bot
added
the
size:S
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 1 file
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".github/workflows/trustabl.yml">
<violation number="1" location=".github/workflows/trustabl.yml:17">
P2: The workflow grants the repository write permissions (`security-events: write`, `pull-requests: write`) to a third-party action pinned by a mutable `@v0` tag rather than a commit SHA. A tag can be force-updated or the upstream repo compromised, and any code the action then runs does so with repo write access. Pin the action to a full commit SHA (and add a comment noting the verified version) to keep the supply chain deterministic.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: trustabl/trustabl-action@v0 |
There was a problem hiding this comment.
P2: The workflow grants the repository write permissions (security-events: write, pull-requests: write) to a third-party action pinned by a mutable @v0 tag rather than a commit SHA. A tag can be force-updated or the upstream repo compromised, and any code the action then runs does so with repo write access. Pin the action to a full commit SHA (and add a comment noting the verified version) to keep the supply chain deterministic.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/trustabl.yml, line 17:
<comment>The workflow grants the repository write permissions (`security-events: write`, `pull-requests: write`) to a third-party action pinned by a mutable `@v0` tag rather than a commit SHA. A tag can be force-updated or the upstream repo compromised, and any code the action then runs does so with repo write access. Pin the action to a full commit SHA (and add a comment noting the verified version) to keep the supply chain deterministic.</comment>
<file context>
@@ -0,0 +1,17 @@
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v4
+ - uses: trustabl/trustabl-action@v0
</file context>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
2 participants
User description
We came across your repo and we like how you are building a universal registry for AI coding tools, simplifying the process of discovering and installing prompts, rules, skills, and agents across different platforms. We scanned the repo, and noticed agent runtime reliability findings that might be worth reviewing.
[HIGH] Subagent granted filesystem-write or web-fetch built-ins
In .claude/agents/blog-writer.md, this subagent's frontmatter grants a filesystem-write (
Write/Edit) or web-fetch (WebFetch) built-in. This could allow the subagent to modify files or access sensitive information online.[HIGH] Subagent granted the built-in Bash tool
In .claude/agents/core-principles.md, this subagent's frontmatter grants the built-in
Bashtool, letting it run arbitrary shell commands. Allowing a subagent to execute arbitrary code poses a significant security risk.[HIGH] Subagent granted filesystem-write or web-fetch built-ins
In .claude/agents/core-principles.md, this subagent's frontmatter grants a filesystem-write (
Write/Edit) or web-fetch (WebFetch) built-in. This could allow the subagent to modify files or access sensitive information online.Recommendations are based on our understanding of agent runtime reliability, some findings may be intentional. Please let us know if this was intentional or if our findings are helpful so we can improve the accuracy of the scanner.
Best,
Trustabl.ai
Open-source AI agent reliability scanner (runs locally, GitHub Action)
CodeAnt-AI Description
Add automated Trustabl security scans to pull requests and main-branch updates
What Changed
mainnow runs a Trustabl security scanImpact
✅ Earlier detection of risky agent permissions✅ Security checks on every pull request✅ Automated monitoring of main-branch changes💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.