{"slug": "show-hn-free-github-action-that-scans-pr-diffs-for-malicious-code-not-quality", "title": "Show HN: Free GitHub Action that scans PR diffs for malicious code, not quality", "summary": "A developer released a free, MIT-licensed GitHub Action that scans pull request diffs for malicious code using regex and semgrep rather than an LLM, targeting command execution, credential access, exfiltration, auto-run hooks, obfuscation, and prompt injection. The deterministic tool is designed to run in CI before AI code review bots such as Greptile, and can trigger those reviewers by pointing them to its findings. The project was posted to Hacker News as a Show HN with 1 point and 0 comments.", "body_md": "I watched a video recently on malicious code injection into OSS repo PRs and how they can go undetected because of how well they're hidden and decided to do a project for this. This tool is essentially used in unison with ai code review bots like greptile. While tools like greptile reason because they run with LLMs, this is a deterministic step before greptile that scans for malicious code (command execution, credential access, exfil, auto-run hooks, obfuscation, and prompt injection; regex + semgrep, no LLM), then can trigger the ai code reviewer like greptile or coderabbit, pointing it to its findings.\n\nIt's free/MIT and runs in your CI.\n\nComments URL: [https://news.ycombinator.com/item?id=49749862](https://news.ycombinator.com/item?id=49749862)\n\nPoints: 1\n\n# Comments: 0", "url": "https://wpnews.pro/news/show-hn-free-github-action-that-scans-pr-diffs-for-malicious-code-not-quality", "canonical_source": "https://github.com/marketplace/actions/vigil-pr-scanner", "published_at": "2026-09-18 03:20:54+00:00", "updated_at": "2026-09-18 03:25:00.586267+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools", "ai-safety", "ai-agents"], "entities": ["GitHub", "Greptile", "CodeRabbit", "Hacker News", "semgrep"], "alternates": {"html": "https://wpnews.pro/news/show-hn-free-github-action-that-scans-pr-diffs-for-malicious-code-not-quality", "markdown": "https://wpnews.pro/news/show-hn-free-github-action-that-scans-pr-diffs-for-malicious-code-not-quality.md", "text": "https://wpnews.pro/news/show-hn-free-github-action-that-scans-pr-diffs-for-malicious-code-not-quality.txt", "jsonld": "https://wpnews.pro/news/show-hn-free-github-action-that-scans-pr-diffs-for-malicious-code-not-quality.jsonld"}}