TL;DR — A malicious GitHub repo can own your machine the moment an AI coding
agent touches it, without a single line of malware in the repo. The payload
lives in a DNS TXT record and is pulled at runtime, so scanners, code review, and
the agent itself never see it. Below is the attack in plain terms and a small,
fail-safe PreToolUse hook that blocks the two actions the attack depends on —
while leaving your own repos untouched.
Reported by 0DIN (Mozilla's GenAI bug bounty), write-up via
Connectors give your agent access to one tool each. This fuses them: a single search across every backend, ranked by meaning, each result tagged with where it came from.
Last tested: 2026-06-19 — @reneza/ats-mcp + @reneza/ats-adapter-composite. See Changelog at the bottom.
If this saves you setup time, follow @renezander030 — practical AI / coding-agent infrastructure notes.
Full repo with the MCP server + adapter source: github.com/renezander030/agentic-task-system
You already have a GitHub connector. This adds the semantic layer: the issues you use as scratchpads, ADRs, and RFC threads become retrievable by meaning.
Last tested: 2026-06-19 — @reneza/ats-mcp + @reneza/ats-adapter-github, GitHub REST 2022-11-28. See Changelog at the bottom.
If this saves you setup time, follow @renezander030 — practical AI / coding-agent infrastructure notes.
Full repo with the MCP server + adapter source: github.com/renezander030/agentic-task-system
You already have a Notion connector. This adds the semantic layer: retrieval ranked by meaning, so the agent pulls the right page on the first try.
Last tested: 2026-06-19 — @reneza/ats-mcp + @reneza/ats-adapter-notion, Notion API 2022-06-28. See Changelog at the bottom.
If this saves you setup time, follow @renezander030 — practical AI / coding-agent infrastructure notes.
Full repo with the MCP server + adapter source: github.com/renezander030/agentic-task-system
An append-only approval-audit table for human-in-the-loop AI pipelines: prove which operator approved which proposed action, what they actually saw, and when — and find actions that executed with no approval at all.
Last tested: June 2026. See Changelog at the bottom.
If this saves you setup time, follow @renezander030 — production AI agent governance in Go.
Reference implementation (MIT, Go): github.com/renezander030/draftcat.
A governed learning loop for production voice agents: harvest call Learning-Items, group them, propose a workflow/prompt diff, gate it behind two human approvals, then publish an auto-versioned workflow.
Last tested: June 2026. See Changelog at the bottom.
If this saves you setup time, follow @renezander030 — production AI agent governance in Go.
Reference implementation (MIT, Go): github.com/renezander030/draftcat — build with
-tags voice.
How to accept an inbound HTTP trigger from another agent or harness in Go without a timing side-channel, an unauthenticated open door, or a request that blocks while the pipeline runs.
Last tested: June 2026. See Changelog at the bottom.
If this saves you from a
==token check, follow @renezander030 — production notes on wiring agents together safely.Working implementation: github.com/renezander030/draftcat (Go, MIT) — the webhook handler, constant-time auth, and the tests below all ship in the repo.
Keep agent prompts in versioned YAML files with a typed output schema, so you edit a prompt without recompiling and a linter catches a broken skill before it ships.
Last tested: June 2026. See Changelog at the bottom.
If this saves you from hardcoded prompt strings, follow @renezander030 — production notes on running LLM agents outside a demo.
Working implementation: github.com/renezander030/draftcat (Go, MIT) — the skill loader,
output_schemavalidator, anddraftcat validatelinter below all ship in the repo.
How to dry-run a multi-step AI agent pipeline against recorded fixtures so go test and CI never hit the model, the CRM, or a real inbox.
Last tested: June 2026. See Changelog at the bottom.
If this saves you from burning tokens in CI, follow @renezander030 — production notes on testing agents that take real actions.
Working implementation: github.com/renezander030/draftcat (Go, MIT) — the
draftcat testcommand below ships in the repo.
Hybrid retrieval (dense + sparse + keyword) with a 15-line RRF implementation, and bench numbers showing why fusion beats any single retriever.
Last tested: 2026-06-12 — Node 20, qdrant 1.x optional, nomic-embed-text via Ollama optional. See Changelog at the bottom.
If this saves you setup time, follow @renezander030 — practical AI / coding-agent infrastructure notes.
Working implementation: github.com/renezander030/agentic-task-system (packages/core/retrieval.js)