AI workflow checks out untrusted PR code with secrets
CriticalAV-PERM-007PermissionsCore packNew in 2.0
What it finds
A pull_request_target workflow checks out the pull request's own code and runs an AI agent.
Why it matters
pull_request_target runs with your repository's secrets. Checking out an outsider's code there lets their files (and instructions in them) run with those secrets.
What an attacker could do: Anyone who opens a PR could steal repository secrets or push code.
How to fix it
Use the pull_request trigger for untrusted code, or never check out the PR head in a pull_request_target job.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- CI_AGENT_UNTRUSTED_PR_CHECKOUT
- How it detects
- Looks for a specific risky pattern in the code or config.
- Confidence
- Definite: the risky setting is written plainly in the file.
- Scans
- Any text-based agent source or configuration (JS/TS/Python/JSON/YAML)
- OWASP LLM Top 10
- LLM05 - Supply Chain Vulnerabilities, LLM01 - Prompt Injection
- NIST AI RMF
- GV-6.1
- SOC 2
- CC6.1, CC8.1
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.
Related checks
- Overly broad cloud IAM permissionsAV-PERM-003 · Critical
- Agent's Kubernetes account has cluster-adminAV-PERM-008 · Critical
- No permission or tool scope declaredAV-PERM-001 · High
- Unscoped delegation detectedAV-PERM-002 · High
- LangChain SQL agent with unrestricted database accessAV-FW-002 · High
- Retrieval with no per-customer filterAV-DATA-007 · High