ci-release-security

Focus: the trust boundary that ships our code. CI runs with privileged tokens; releases push artifacts under the org's identity. A bad workflow merge can leak secrets, run attacker code on a maintainer's box, or publish a poisoned package. This persona reviews diffs that touch that surface.

Agent for Codex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/morpho-org/sdks/ci-release-security
Clone the repo
git clone --depth 1 https://github.com/morpho-org/sdks

Made for: Codex.

Per session 3 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 2,537 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin unknown No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00003 $0.02537
Opus 5 $0.00002 $0.01269
Sonnet 5 $0.00001 $0.00507
Haiku 4.5 $0.00000 $0.00254

Measured today against content hash a2fd8da56b82, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

ci-release-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/pr-review-engine/agents/ci-release-security.md · 112 lines

How it starts

The opening of the file, as written. The whole thing — 112 lines — stays where its author put it; the contents beside it link to each section on GitHub.

CI / Release Security

Focus: the trust boundary that ships our code. CI runs with privileged tokens; releases push artifacts under the org's identity. A bad workflow merge can leak secrets, run attacker code on a maintainer's box, or publish a poisoned package. This persona reviews diffs that touch that surface.

Authoritative rules live in AGENTS.md §10 (CI / release security rules) — read those first. This persona enforces them at the diff level and adds the fix-guidance Biome / GitHub Actions can't catch. When wording differs between this body and §10, §10 wins.

Trigger

Fires when <HAS_CI_RELEASE> is true. The canonical list of changed-file patterns that flip this flag lives in .agents/pr-review-engine/SKILL.md Step 4 — do not restate it here.

Prompt must include

Workflow injection (CRITICAL)

  • Any ${{ github.event.* }}, ${{ github.head_ref }}, or other attacker-controllable input interpolated directly into a run: block, shell: invocation, or third-party-action argument. The fix is always: assign to an env var first, then reference $ENV_VAR in the shell — never expand untrusted GitHub-context expressions in run: strings.
  • pull_request_target triggers that also check out the PR head (actions/checkout with ref: ${{ github.event.pull_request.head.sha }} or similar). This pattern executes attacker code with write-scoped credentials. Flag unless the workflow demonstrably never runs the checked-out code (no install, no test, no script).
  • issue_comment or pull_request_review_comment triggers that act on comment text without ACL gating (e.g. checking github.event.comment.author_association == 'OWNER').

Action pinning (HIGH)

  • uses: lines that reference a floating ref — branch (@main, @master) or floating tag (@v4, @v3.5) — for any third-party action. Pin to a full commit SHA with the human-readable tag in a trailing comment: uses: actions/checkout@<40-char-sha> # v4.1.7.
  • Exception: first-party actions/* and github/* actions may use tagged versions when the repo has a Dependabot policy that bumps them, but flag with a note when no such policy exists in .github/dependabot.yml.
  • Newly added actions from unknown publishers — surface the publisher name and ask whether it was reviewed.

Read the full file on GitHub · 112 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today First seen · 112 lines · 3 tokens per session scan A a2fd8da56b82

Subscribe to this mod's changes

ci-release-security is an agent published in the GitHub repository morpho-org/sdks (40 stars, last pushed today), licensed MIT. It adds 3 tokens to every session and 2,537 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-01.