reyracom/NIfra AI Security Scan
Automated exploit simulation, attack surface mapping & pipeline protection for LLM apps and AI agents. Detects prompt injection, RAG poisoning, tool abuse, excessive agency, and supply chain vulnerabilities.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Mar 16, 2026
- License
- None
Pinned Snippet
uses: reyracom/nifra-agent@579d18c470c1a442024b73df28afa4dd7f3b02a9 # v0.2.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| target | Path to the AI application directory to scan (relative to workspace root) | no | . |
| fail-on | Exit with error code if findings at this severity or above. Options: critical, high, medium | no | critical |
| output-file | Path to save JSON scan results (relative to workspace root) | no | nifra-results.json |
| sarif-file | Path to save SARIF output for GitHub Security tab (relative to workspace root) | no | nifra.sarif |
| no-ai | Skip LLM reasoning — deterministic findings only (no OPENAI_API_KEY required) | no | false |
| openai-api-key | OpenAI API key for AI-powered exploit reasoning. If not set, uses --no-ai mode. | no | "" |
| python-version | Python version to use for NIfra | no | 3.12 |
| nifra-version | NIfra version to install (default: latest) | no | "" |
| upload-sarif | Upload SARIF results to GitHub Security tab (requires Advanced Security) | no | true |
| post-pr-comment | Post scan results as a PR comment (only on pull_request events) | no | true |
Outputs
| name | description |
|---|---|
| risk-level | Overall risk level: CRITICAL | HIGH | MEDIUM | LOW |
| findings-count | Total number of findings |
| critical-count | Number of CRITICAL findings |
| sarif-path | Path to the generated SARIF file |