This tool doesn't seem to work very well. I tried to run it against my own harness that uses the Anthropic SDK(s) in Go and it turns up nothing. It doesn't seem to understand Go code?
I build agent tooling and kept hitting the same thing: tools validate that a
request is well-formed, but almost nothing checks that this caller was
authorised to do this specific action. So I wrote a scanner for that one shape,
a model-controlled parameter reaching a consequential sink (payments, deletion,
shell, SQL, egress) with no authorisation check dominating the path.
Then I ran it across 25 pinned repos, 23,476 files, and hand-triaged every
finding.
The part I'd most like scrutinised: the first run was 81% precise. 12 of 63
findings were wrong. A Kubernetes rule matched Elasticsearch clients at HIGH
severity. A SQL rule caught hardcoded DROP TABLE and missed caller-controlled
execute(query), exactly backwards. I've since found and corrected more,
including tools guarded by human-in-the-loop primitives I didn't recognise.
Every correction is in the study.
What it can't do, stated plainly: guard soundness is undecidable, so it checks
that a guard call dominates the path and shares a parameter with the sink —
not that the guard is correct. It covers three agent architectures out of
seven; custom agent loops are NOT COVERED because that heuristic produced
10 false positives out of 10 candidates and I dropped it rather than ship it.
pipx run actenon-scan scan .
Zero runtime dependencies, nothing uploaded, Python and TypeScript. If you can
make it report clean on something that obviously isn't, I'd genuinely like the
case — the benchmark has a soundness suite specifically for that and it's the
part I trust least.
This tool doesn't seem to work very well. I tried to run it against my own harness that uses the Anthropic SDK(s) in Go and it turns up nothing. It doesn't seem to understand Go code?
I build agent tooling and kept hitting the same thing: tools validate that a request is well-formed, but almost nothing checks that this caller was authorised to do this specific action. So I wrote a scanner for that one shape, a model-controlled parameter reaching a consequential sink (payments, deletion, shell, SQL, egress) with no authorisation check dominating the path.
Then I ran it across 25 pinned repos, 23,476 files, and hand-triaged every finding.
The part I'd most like scrutinised: the first run was 81% precise. 12 of 63 findings were wrong. A Kubernetes rule matched Elasticsearch clients at HIGH severity. A SQL rule caught hardcoded DROP TABLE and missed caller-controlled execute(query), exactly backwards. I've since found and corrected more, including tools guarded by human-in-the-loop primitives I didn't recognise. Every correction is in the study.
What it can't do, stated plainly: guard soundness is undecidable, so it checks that a guard call dominates the path and shares a parameter with the sink — not that the guard is correct. It covers three agent architectures out of seven; custom agent loops are NOT COVERED because that heuristic produced 10 false positives out of 10 candidates and I dropped it rather than ship it.
Zero runtime dependencies, nothing uploaded, Python and TypeScript. If you can make it report clean on something that obviously isn't, I'd genuinely like the case — the benchmark has a soundness suite specifically for that and it's the part I trust least.