{"slug": "repopilot-how-an-aws-lambda-agent-scores-github-repos-before-you-clone-them", "title": "RepoPilot: How an AWS Lambda Agent Scores GitHub Repos Before You Clone Them", "summary": "A developer built RepoPilot, a serverless agent on AWS Lambda and Bedrock that scores public GitHub repositories on a 0-100 risk scale before cloning, flagging dangerous install steps and returning a sanitized setup path. The tool combines static regex checks on install scripts with LLM analysis of dependency manifests, weighted across contributor diversity, commit frequency, dependency risk, install-script safety and documentation quality. It targets the gap exploited by the FakeGit campaign, in which 7,600 fake repositories—800 posing as AI skills and MCP servers—were recommended by coding assistants that read READMEs but never validated commit history or dependencies.", "body_md": "7,600 fake repositories shipped in 2026, with 800 posing as AI skills and MCP servers. Security researchers at Island documented a campaign where coding assistants surfaced malicious repos without any attacker-supplied link. Ask Claude or Gemini for a \"free Walmart MCP server\" and you might get an attacker's repo as the top recommendation.\n\nRepoPilot is a serverless agent that scores any public GitHub repository before you clone it. Built on AWS Lambda and Bedrock, it returns a 0-100 risk score, flags dangerous install steps, and provides a sanitized setup path. The architecture shows how to build a developer-workflow gatekeeper that runs in under two minutes without standing infrastructure.\n\nAI coding assistants read README files as documentation. They do not inspect commit history, contributor patterns, or dependency graphs. When an agent recommends a repository, it vouches for content it never validated.\n\nThe FakeGit campaign exploited this gap. Attackers created repositories with convincing documentation and release assets that totaled 14 million downloads. The repos included install scripts designed to exfiltrate credentials, and the agents recommended them based purely on textual similarity to legitimate projects.\n\nPre-clone validation moves the security boundary earlier. Instead of scanning after installation, the agent evaluates the repository before you run `git clone`.\n\nRepoPilot runs as a single Lambda function triggered by an HTTP request. The orchestration flow:\n\nThe function does not clone the repository. It reads files through the GitHub Contents API, which returns base64-encoded blobs. This keeps the Lambda execution under 512 MB memory and avoids disk I/O.\n\nRepoPilot is stateless. Each invocation:\n\nNo DynamoDB table, no S3 staging bucket, no SQS queue. This simplifies deployment but means repeated requests for the same repo hit GitHub and Bedrock every time. For production use, you would add a caching layer (ElastiCache or DynamoDB with TTL) keyed on `repo_url + commit_sha`.\n\nUnauthenticated requests to GitHub get 60 calls per hour per IP. Authenticated requests (with a personal access token) get 5,000 per hour. The Lambda function accepts an optional `GITHUB_TOKEN` environment variable.\n\nWithout a token, the agent can score about 10 repositories per hour before hitting the limit. With a token, you can process hundreds. The function does not implement retry logic or exponential backoff. If GitHub returns a 403, the Lambda returns an error immediately.\n\nFor high-volume use, you would:\n\nThe agent combines LLM analysis with static rules. The final score is a weighted average:\n\n| Signal | Weight | Source | \n|---|---|---|\n| Contributor diversity | 20% | GitHub API (commit authors, PR reviewers) | \n| Commit frequency | 15% | GitHub API (last 90 days) | \n| Dependency risk | 25% | Bedrock analysis of package.json, requirements.txt, go.mod | \n| Install script safety | 30% | Bedrock analysis of setup.sh, Makefile, install scripts | \n| Documentation quality | 10% | Bedrock analysis of README, CONTRIBUTING | \n\nThe agent sends package manifests to Bedrock with a prompt:\n\n```\nprompt = f\"\"\"\nAnalyze this dependency list for supply-chain risks.\nFlag any packages that:\n- Use wildcards or unpinned versions\n- Come from unverified registries\n- Have known CVEs in the specified version range\n- Include install hooks (postinstall, setup.py commands)\n\nReturn JSON: {{\"risk_score\": 0-100, \"flags\": []}}\n\nManifest:\n{manifest_content}\n\"\"\"\n```\n\nBedrock returns structured output. The Lambda parses the JSON and incorporates the risk score into the final calculation.\n\nThe agent reads any file named `install.sh`, `setup.sh`, `Makefile`, or `bootstrap` and checks for:\n\n`curl | bash` patterns`~/.aws`, `~/.ssh`, environment variable reads)\nThese checks run as regex patterns before the LLM sees the script. If any pattern matches, the score drops by 20 points immediately. The LLM then provides a natural-language explanation of the risk.\n\nLambda cold starts add 2-4 seconds when the function has not run recently. Warm invocations complete in 8-12 seconds, depending on Bedrock response time.\n\nBedrock invocation is synchronous. The Lambda calls `bedrock_runtime.invoke_model()` and blocks until the response arrives. Nova Pro typically responds in 3-6 seconds for a 2,000-token input.\n\nTo reduce latency:\n\n`invoke_model_with_response_stream`) let you return partial scores before the full analysis completes\nThe current implementation prioritizes simplicity over speed. For a developer workflow tool, 10 seconds is acceptable. For a CI/CD gate that blocks merges, you would need sub-second response times and would likely move to a persistent service (ECS or EKS) with a connection pool to Bedrock.\n\nA legitimate repository with aggressive install automation can score poorly. For example:\n\n`curl`\n`~/.bashrc` for shell integration\nThe agent flags these as risky even when the maintainer is trustworthy. To handle this:\n\nIf GitHub is down or rate-limited, the Lambda cannot fetch metadata. The function returns a 503 error with a message. You cannot score a repo without reading its files.\n\nA production system would:\n\nBedrock has per-account quotas. Nova Pro allows 10 requests per second by default. If you exceed this, the Lambda gets a `ThrottlingException`.\n\nThe function does not retry. It returns an error immediately. For production:\n\nThe entire stack is defined in a single CloudFormation template:\n\n`bedrock:InvokeModel` and `logs:CreateLogGroup` permissions\nNo VPC, no NAT gateway, no load balancer. The function runs in the AWS-managed Lambda environment and calls public APIs (GitHub and Bedrock) over the internet.\n\nCost per invocation:\n\nAt 1,000 scores per day, monthly cost is roughly $20.\n\nThe Lambda writes structured logs to CloudWatch:\n\n```\n{\n  \"timestamp\": \"2026-10-20T00:15:32Z\",\n  \"repo_url\": \"https://github.com/example/repo\",\n  \"score\": 72,\n  \"bedrock_latency_ms\": 4200,\n  \"github_api_calls\": 5,\n  \"flags\": [\"unpinned_dependencies\", \"curl_in_install\"]\n}\n```\n\nYou can build CloudWatch Insights queries to track:\n\nFor production, you would add:\n\nThe agent runs in your AWS account. It does not send repository content to any third-party service except AWS Bedrock. GitHub API calls are read-only and do not require write permissions.\n\nRisks:\n\n**Use RepoPilot when:**\n\n**Avoid it when:**\n\nThe architecture is simple enough to fork and extend. Add caching, swap Bedrock for a local model, or integrate with your CI/CD pipeline. The core insight is that serverless agents can gate developer actions without requiring standing infrastructure.", "url": "https://wpnews.pro/news/repopilot-how-an-aws-lambda-agent-scores-github-repos-before-you-clone-them", "canonical_source": "https://dev.to/mech_app_ai/repopilot-how-an-aws-lambda-agent-scores-github-repos-before-you-clone-them-4k3k", "published_at": "2026-10-20 00:07:31+00:00", "updated_at": "2026-10-20 00:15:35.133543+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "ai-safety", "developer-tools", "ai-infrastructure"], "entities": ["RepoPilot", "AWS Lambda", "Amazon Bedrock", "GitHub", "Island", "FakeGit", "Claude", "Gemini"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/repopilot-how-an-aws-lambda-agent-scores-github-repos-before-you-clone-them", "markdown": "https://wpnews.pro/news/repopilot-how-an-aws-lambda-agent-scores-github-repos-before-you-clone-them.md", "text": "https://wpnews.pro/news/repopilot-how-an-aws-lambda-agent-scores-github-repos-before-you-clone-them.txt", "jsonld": "https://wpnews.pro/news/repopilot-how-an-aws-lambda-agent-scores-github-repos-before-you-clone-them.jsonld"}}