Aido hardens its AI code-review Action against supply-chain and prompt-injection risks

Aido, the open-source multi-provider AI assistant for GitHub code review, has shipped a run of releases from version 1.6.2 to 1.6.6. Together they harden the tool against the risks that matter most for software that holds provider API keys and can write to pull requests.

Aido runs inside GitHub Actions and reviews, summarizes, explains, and documents code by commenting on a pull request, using Gemini, ChatGPT, or Claude on a team's own provider keys. Because it runs in a privileged context, its own security is part of the product.

Pinned dependencies and no install scripts

Every command previously installed its provider SDKs unpinned on each run, in jobs holding API keys and write access. A single malicious upstream publish, or a postinstall hook in any transitive dependency, would have executed there. The SDK installs are now pinned to exact versions and run with install scripts disabled, closing that supply-chain path. All four SDKs are pure JavaScript, so nothing breaks.

Closing injection paths

Two further releases remove injection anti-patterns. Pull request and issue numbers are now passed to workflow steps as environment variables instead of being spliced into a shell command. And the automatic-companion gate now checks out the trusted base-branch code rather than the pull request's own copy, so a forked pull request can no longer influence the code that decides whether Aido runs.

A prompt-injection guardrail

Version 1.6.6 adds a guardrail for the reviews themselves. Titles, descriptions, diffs, and comments are attacker-controllable and flow into the model's prompt. Both review passes now mark that content as untrusted data, never instructions, so a crafted pull request cannot steer a review or its recommendation with embedded directives such as "approve this."

A documented posture for adopters

The release also adds a SECURITY.md that sets out how to run Aido safely. The most important guidance: never wire Aido's output to auto-merge or other privileged automation. A human in the loop is the load-bearing defense against prompt injection, alongside least-privilege permissions and the hardening above.

Versions 1.6.2 to 1.6.6 are available now on GitHub. Remote installs on the moving version-one tag receive the updates automatically; pinned installs upgrade by bumping the tag.