{
  "id": 15672684,
  "title": "RepoPilot: How an AWS Lambda Agent Scores GitHub Repos Before You Clone Them",
  "url": "https://urgent.news/2026/10/20/repopilot-how-an-aws-lambda-agent-scores-github-repos-before-you",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-20T00:07:31.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/mech_app_ai/repopilot-how-an-aws-lambda-agent-scores-github-repos-before-you-clone-them-4k3k"
  },
  "original_language": "en",
  "account": "A serverless agent called RepoPilot uses AWS Lambda and Bedrock to evaluate GitHub repositories before you clone them. This tool aims to mitigate security risks associated with fake repositories. Several fake GitHub repositories were distributed in 2026, posing as AI technologies and MCP servers. When developers ask coding assistants like Claude or Gemini for a free MCP server, they might receive a malicious repository as the top recommendation. RepoPilot scores the repositories on a 0-100 risk scale, flags dangerous installation steps, and provides a sanitized setup path.\n\nThe architecture is built on AWS Lambda and Bedrock, allowing it to run in under two minutes without any standing infrastructure. The supply chain problem exists because AI coding assistants rely solely on README files as documentation, failing to inspect commit history, contributor patterns, and dependency graphs. Attackers leveraged this gap with the FakeGit campaign, creating repositories with convincing documentation and release assets totaling 14 million downloads. These repositories contained malicious install scripts designed to exfiltrate credentials, which coding assistants recommended based on textual similarity to legitimate projects.\n\nRepoPilot's architecture is simple. It runs as a single Lambda function triggered by an HTTP request. The Lambda fetches repository metadata via the GitHub API, analyzes the repository using Bedrock (Nova Pro), and returns a JSON response with the risk score, flagged risks, and sanitized setup steps. The function is stateless, fetching fresh data for each invocation from the GitHub Contents API and returning the complete response in one round trip. This stateless design simplifies deployment but means repeated requests for the same repository hit GitHub and Bedrock each time.\n\nGitHub imposes rate limits: unauthenticated requests get 60 calls per hour per IP, and authenticated requests (with a personal access token) receive 5,000 calls per hour. The Lambda function accepts an optional GITHUB_TOKEN environment variable; without a token, it can score about 10 repositories per hour before hitting the limit, but with a token, it can process hundreds. The function doesn't implement retry logic or exponential backoff, so if GitHub returns a 403, the Lambda immediately returns an error. For high-volume use, you should store tokens in Secrets Manager, rotate tokens using a round-robin strategy, and add a DynamoDB table to track per-token rate limit state.\n\nRepoPilot combines LLM analysis with static rules to score repositories. The final score is a weighted average: 20% from contributors' diversity (GitHub API), 15% from commit frequency (GitHub API), 25% from Bedrock analysis of package manifests, 30% from Bedrock analysis of install scripts, and 10% from Bedrock analysis of README files. The agent sends package manifests to Bedrock for analysis, which returns a JSON object with a risk score and any flags. The Lambda parses this JSON and incorporates the risk score into the final calculation.\n\nThe agent checks install scripts for safety by looking for patterns like `curl | bash`, credential access (e.g., `~/.aws`), sudo commands without explanation, or network calls to non-GitHub domains. If any pattern matches, the score drops by 20 points immediately. The LLM then provides a natural-language explanation of the risk.\n\nCold starts add 2-4 seconds when the Lambda function hasn't run recently. Warm invocations take 8-12 seconds, depending on Bedrock's response time. Bedrock invocation is synchronous, blocking until the response arrives. To reduce latency, you can provision a Lambda concurrency instance ($0.015 per hour per instance), use async invocation with Step Functions to return a job ID immediately and poll for results, or stream responses from Bedrock for partial scores. For a developer workflow tool, 10 seconds is acceptable, but for a CI/CD gate that blocks merges, you would need sub-second response times, suggesting a move to a persistent service like ECS or EKS with a connection pool to Bedrock.",
  "summary": "7,600 fake repositories shipped in 2026, with 800 posing as AI skills and MCP servers. Security researchers at Island documented a campaign where coding assistants surfaced malicious repos without any attacker-supplied link. Ask Claude or Gemini for a \"free Walmart MCP server\" and you might get an attacker's repo as the top recommendation. RepoPilot is a serverless agent that scores any public…",
  "key_points": [],
  "editors_take": "Automating repository inspection through serverless agents addresses a critical vulnerability where AI coding assistants recommend malicious projects based solely on deceptive documentation and superficial textual similarities.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}