Check C22 · agent provenance family · severity CRITICAL · extension only · one of the 22 checks
The question this check asks: did an AI surface — a chat assistant or an MCP directory — lead you to this repository? Not whether the repository mentions AI. Whether the route you took to it went through one.
In July 2026 Island's security research named the technique AgentBaiting. Of the roughly 7,600 FakeGit repositories, over 800 posed as AI Skills or MCP servers, and the campaign seeded more than 600 listings into public registries — LobeHub, Glama, MCP.so and MCP Market. No attacker ever had to send a link. When Island asked Claude Code, Gemini and ChatGPT for a capability, each assistant found a campaign repository through ordinary search, read the attacker's README as documentation, and handed over the install instructions. Gemini returned one of the fakes as its first recommendation; ChatGPT called the same repository the best place to start.
The recommendation is the attack. A developer who would squint at a link in an e-mail will paste a command an assistant wrote for them, because the assistant's confidence reads as vetting. It is not vetting. An agent recommendation is, right now, the opposite of a trust signal.
This is also the one check that cannot run anywhere but the browser. The signal exists only at navigation time: which tab you came from, which tab opened this one. A backend never sees it, a command-line scanner is never invoked, and a package-registry monitor is watching the wrong thing. That is why C22 is the check RepoGates built first.
The extension holds permission for an enumerated list of eleven hosts: six AI chats (claude.ai, chatgpt.com, chat.openai.com, gemini.google.com, copilot.microsoft.com, perplexity.ai) and five MCP directories (lobehub.com, glama.ai, mcp.so, mcpmarket.com, smithery.ai). Arriving at a GitHub repository from one of them — in the same tab, in a tab it opened, or by referrer — records that provenance for 30 minutes. Tab lineage is the primary signal because those surfaces commonly emit rel="noreferrer" links; the referrer is supplementary. If a download of that repository starts inside the window, the verdict request carries prov=agent and the surface's hostname only.
The score follows the verdict, and the verdict depends on what the other 21 checks found. On a repository that would otherwise be REVIEW, C22 is added as CRITICAL, costs 25 points and escalates the verdict to BLOCK — the default personal policy is warn_to_block; strict profiles use always_block. On a repository that passes, C22 is recorded as an INFO line costing 5 points and the verdict stays PASS. A repository already at BLOCK needs no help. The evidence note in the scoring table:
“C22: AgentBaiting channel; INFO row (recorded on PASS) costs a little, CRIT (escalated) a lot”
Either way the decision page carries a provenance note — “An AI surface (claude.ai) led you to this repository” — so the fact is in front of you even when it changed nothing.
Every legitimate repository an assistant recommends carries the provenance note, and assistants recommend legitimate repositories far more often than not. That is the reason C22 never blocks on its own: a clean, established project you reached from ChatGPT stays PASS with a five-point information line, and the board tells you why the line is there. The escalation only bites when the repository already has a problem — a fresh maintainer account, a binary release asset, an install script — and then the fact that an assistant sent you is the thing that tips a warning into a block.
A second case: you asked an assistant, then typed the repository name into a new tab by hand. There is no lineage and no referrer, so C22 does not fire. The check sees navigation, not intent.
It sees browser navigations from an enumerated list. A surface not on the list is invisible until an extension update adds it — the remote configuration can switch hosts within the list on and off, but cannot add one, by the store's own remote-code rule. It does not see what you asked, what the assistant said, or the page you were on; it sends a hostname. It does not read the repository: a recommended repository that trips nothing else is not blocked, because a recommendation is not evidence.
And it does not see an agent that fetches code itself. RepoGates as a whole gates browser downloads only — it does not see git clone, package managers, curl, or fetches made by AI agents outside the browser. For that path the product offers an MCP server an agent can be told to call before it fetches; an agent that never calls it is not stopped, and we do not say otherwise.
Without installing anything: when an assistant hands you a repository, treat it as an unverified search result, not a referral. Open the owner's profile and read the Joined date; open the registry listing, if there is one, and read its age. Then verify the publisher out of band — a project website, a package on a registry you already trust, a named person with a history. With the GitHub CLI, the two fields that matter most:
gh api repos/OWNER/REPO --jq '{created_at, stargazers_count, owner: .owner.login}'
gh api users/OWNER --jq .created_atA repository and an account created the same month, recommended by an assistant, with install instructions that download a ZIP: that is the AgentBaiting shape end to end. The vetting standard's rule is blunt — agent-discovered repositories get the full treatment and out-of-band publisher verification, no exceptions.
Does an AI recommendation mean the repository is malicious? No. Assistants recommend legitimate repositories all day. That is why C22 changes nothing on a repository that passes every other check: it is recorded as an information line costing 5 points. It only escalates — a warning becomes a block, 25 points — when the repository already has a problem. Provenance is suspicion, not evidence.
Does RepoGates see what I asked the assistant? No. The extension watches navigation on an enumerated list of eleven hosts only and sends the hostname of the surface — claude.ai, for example — with the verdict request. Never the page URL, never the conversation, never the prompt.
Does RepoGates stop an AI agent from fetching code itself? No. C22 sees a person who followed a recommendation into a browser download. An agent that clones or fetches on its own is outside the browser, and RepoGates does not see git clone, package managers, curl, or agent fetches. The MCP server is a tool an agent can be told to call before it fetches; an agent that never calls it is not stopped.
C1 Owner account age — the finding that most often turns an agent-surfaced REVIEW into a BLOCK · C18 Agent config files — instruction files the agent will read before you do · C20 MCP shell-launch config — a checked-in MCP configuration whose command runs something.
Add RepoGates to Chrome Pricing
Numbers on this page: Island, AgentBaiting, 20 July 2026 (800+ Skill and MCP imposters, 600+ registry listings, assistant behaviour); Cloud Security Alliance research note, 21 July 2026. The mechanism is described in the agents guide; weights from the product's scoring table.