ShadowAgent Guard

THE PROBLEM AI coding agents like IBM Bob, Copilot and Cursor now follow instruction and permission files that live inside the repository: AGENTS.md, rules folders, custom modes and MCP server configs. The agent obeys these files, which makes them a new attack surface. A pull request or a cloned repo can hide instructions in invisible Unicode characters that a human reviewer cannot see in the diff, auto-approve a shell tool through MCP, or give an agent mode unrestricted edit and command rights. AI-written code also introduces "slopsquatted" dependencies: package names the model invented, which attackers can register. Research on code-generating models has found that roughly one in five recommended packages did not exist. Existing reviewers, including Bob's own /review, check the application code. None of them check the AI supply chain: the dependencies an agent invents and the files that tell the agent what to do. THE SOLUTION ShadowAgent Guard is a security gate for AI-native threats, built on IBM Bob 2.0. It protects three points in the developer workflow: 1. Before the agent starts work: a global Bob lifecycle hook scans any workspace when Bob is prompted in it. If the repo is hostile, the prompt is blocked before it reaches the model and the developer sees a warning listing each finding. 2. During review: inside Bob, /guard runs a dedicated ShadowAgent Guard mode that launches three parallel subagents (dependencies, agent configuration, test integrity), merges their findings, gives a BLOCK or PASS verdict with a trust grade from A to F, and writes hardened replacement configs with an explanation for every change. 3. In CI: a one-line GitHub Action (uses: Ahmadbey678/ShadowAgent-Guard@main) fails pull requests that carry these risks, posts the report to the job summary and uploads SARIF to GitHub Code Scanning. WHAT IT CATCHES Nonexistent and typosquatted packages, checked against the live PyPI and npm registries; malicious install scripts; hidden-Unicode instructions, decoded to show what the agent actually reads; prompt injection in rules files; auto-approved MCP shell tools; over-permissive agent modes; secrets not covered by .bobignore; and tests that were deleted, skipped or weakened to make a PR pass. MEASURED IMPACT On the demo repository, an AI-generated pull request with 11 planted issues, ShadowAgent Guard caught all 11 (13 findings, grade F, BLOCK) in about one second. The same PR after remediation passes with grade B. Several of these issues, such as invisible Unicode instructions, cannot be found by manual review at all. TARGET USERS Teams adopting AI coding agents who need to trust the repositories and pull requests those agents work on. Developers get a warning in their IDE, reviewers get a verdict and ready-made fixes, and the pipeline gets a gate. It needs no dependencies, adopts in one line of CI config, and reports render in the browser without being uploaded anywhere. WHAT IS NEW ShadowAgent Guard secures the agent itself, not just the code it writes, and uses Bob to audit and harden Bob's own attack surface.