REPOSITORY SCANNING

What each scanner actually looks at

Four tools that all get called security scanners, and that do not read the same files. This page is only about what can be found in a repository before anyone runs anything. Nothing here is about governing a running agent.

At a glance

Capability	node9	Snyk	pipelock	Scorecard	HOL Guard	zizmor
Hijackable agent workflowsa stranger's issue or PR text reaching an agent that holds secrets	Yes	No	No	Partly	Partly	Partly
Secrets the agent can reachfrom the job or machine it runs on	Yes	No	No	Partly	Partly	Partly
Agent tool permissionswhat the agent is allowed to run	Yes	Partly	No	–	Partly	–
Hooks that fetch and run remote codea committed agent hook that pulls a script at run time	Yes	No	No	–	Partly	–
MCP serversunpinned, or holding a secret in the config	Yes	Partly	No	Partly	Partly	–
Poisoned instruction filesCLAUDE.md, AGENTS.md, .cursorrules carrying a payload	Yes	No	Partly	–	No	–
Skills, subagents and slash commandsthe files an agent loads on demand	Yes	Yes	Yes	–	Yes	–
PR gatefails only on what the pull request introduced	Yes	No	Partly	No	No	No
Live badge for any public repositoryshows the latest result and updates after a push	Yes	No	Partly	Yes	No	No

Hover a cell for the detail. – means the tool does not look at this.

Where each one stands

node9 scan-repoDoes this repository contain configuration that lets a stranger hijack the agent?The agent surface committed to the repo: workflows, .claude, .mcp.json, CLAUDE.md.

Snyk agent-scanAre the servers and tools installed on my machine poisoned?The developer's machine. It connects to live MCP servers and reads their tool descriptions.

pipelock auditIs pipelock itself configured properly, and did this diff add a secret?Its own configuration, scored across categories, plus secret scanning on the diff.

OpenSSF ScorecardIs this project maintained to good engineering practice?The repo as a software project: branch protection, code review, signed releases. Not a competitor. We measure ourselves against it.

The table

The agent surface committed to the repo

Everything a pull request can change without anyone reading it closely.

What is being asked	node9	Snyk	pipelock	Scorecard
A workflow that feeds a stranger's text to the agentan issue or PR from an unknown account reaching an agent that holds secrets	●	○	○	◐
Secrets the agent can reach from where it runsa cloud key or an id-token within reach of an agent that has a shell	●	○	○	◐
The list of tools the agent is allowed to callBash() and Write() sitting in .claude/settings.json	●	◐	○	·
Hooks that fetch and run remote codean unpinned curl or npx on the agent's hot path	●	○	○	·
The script the hook points atwe read the command line, not the file it executes	○	○	○	·
MCP servers unpinned, or holding a secretnpx @latest, or a token sitting inside .mcp.json	●	◐	○	◐
Instruction files that carry a payloadconcealed characters, or curl piped to a shell, inside CLAUDE.md	●eight signals, four of them semantic	○	◐hidden characters only	·
Skills, subagents and slash commandscommitted files the agent loads on its own: .claude/skills, .claude/agents, .claude/commands	●the same eight signals as CLAUDE.md	●	●skill-scan, with a diffable lock	·

What this pull request introduced

The question a reviewer is actually asking, which is not the same as how many problems the repo has.

What is being asked	node9	Snyk	pipelock	Scorecard
New findings only, measured against the base branchthis PR added one problem, rather than this repo has twelve	●shipped in 2.12.0	○	◐secrets only	○
A secret added in this diffa key pushed in this commit	◐	○	●	○
Findings placed on the source line in the reviewa comment on line 42, not a log to open in another tab	○	●	○	○
A way to suppress a finding you have acceptedthe same warning on every PR until people stop reading them	○	●	●exemption records	○

The developer's machine

What is being asked	node9	Snyk	pipelock	Scorecard
Which agents and MCP servers are actually installed herediscovering what is running, rather than what is committed	●	●	●	·
Tool descriptions from a live MCP serverinjection in a tool description, shadowing, a change after install	○	●	●	·

Engineering hygiene of the repo itself

What is being asked	node9	Snyk	pipelock	Scorecard
Branch protection, code review, signed releasesa 0 to 10 score for the project as a software project	○	○	◐scores its own config	●

● covers this◐ partial, or with a condition○ does not cover this· outside the tool's model

How to read it

Scorecard is a measuring stick, not a rival

It checks whether a project is maintained properly. The only two of its checks that touch the same files we do are Dangerous-Workflow and Token-Permissions, and neither has any concept of an agent: they cannot tell a build step from an AI agent holding a shell. We measure node9 against it and publish the number.

The one empty row is the roadmap

The script a hook points at is a committed file that executes on the agent's behalf, and nobody in this table reads it. Skills, subagents and slash commands were in the same position until this week; they are now read with the same eight signals as CLAUDE.md. The hook script is the row that remains.

Measured 9 September 2026 against each tool's own source and documentation.

The other question is on its own page: node9 vs agentsh vs pipelock: what actually stops an agent mid-task.