I scanned my AI agent framework for destructive/consequential actions, and wow

This tool doesn't seem to work very well. I tried to run it against my own harness that uses the Anthropic SDK(s) in Go and it turns up nothing. It doesn't seem to understand Go code?

I build agent tooling and kept hitting the same thing: tools validate that a request is well-formed, but almost nothing checks that this caller was authorised to do this specific action. So I wrote a scanner for that one shape, a model-controlled parameter reaching a consequential sink (payments, deletion, shell, SQL, egress) with no authorisation check dominating the path.

Then I ran it across 25 pinned repos, 23,476 files, and hand-triaged every finding.

The part I'd most like scrutinised: the first run was 81% precise. 12 of 63 findings were wrong. A Kubernetes rule matched Elasticsearch clients at HIGH severity. A SQL rule caught hardcoded DROP TABLE and missed caller-controlled execute(query), exactly backwards. I've since found and corrected more, including tools guarded by human-in-the-loop primitives I didn't recognise. Every correction is in the study.

What it can't do, stated plainly: guard soundness is undecidable, so it checks that a guard call dominates the path and shares a parameter with the sink — not that the guard is correct. It covers three agent architectures out of seven; custom agent loops are NOT COVERED because that heuristic produced 10 false positives out of 10 candidates and I dropped it rather than ship it.

  pipx run actenon-scan scan .