
Research
Malicious Go “crypto” Module Steals Passwords and Deploys Rekoobe Backdoor
An impersonated golang.org/x/crypto clone exfiltrates passwords, executes a remote shell stager, and delivers a Rekoobe backdoor on Linux.
git-bob
Advanced tools
git-bob uses AI to solve Github-issues. It runs inside the Github CI, no need to install anything on your computer.

git-bob uses AI to solve GitHub issues. It runs inside the GitHub CI, no need to install anything on your computer. Read more in the publication.

Under the hood it uses Anthropic's Claude or OpenAI's chatGPT or Google's Gemini to understand the text and pygithub to interact with the issues and pull requests. As its discussions are conserved, you can document how things were done using AI and others can learn how to prompt for the things you did. For example, the pair-plot discussion above is available online.
git-bob is a research project aiming at streamlining GitHub interaction in software development projects. Under the hood it uses
artificial intelligence / large language models to generate text and code fulfilling the user's requests.
Users are responsible to verify the generated code according to good scientific practice.
When using git-bob you configure it to use an API key to access the AI models.
You have to pay for the usage and must be careful in using the software.
Do not use this technology if you are not aware of the costs and consequences.
[!CAUTION] When using the Anthropic, OpenAI, Google Gemini, Mistral or any other endpoint via git-bob, you are bound to the terms of service of the respective companies or organizations. The GitHub issues, pull requests and messages you enter are transferred to their servers and may be processed and stored there. Make sure to not submit any sensitive, confidential or personal data. Also using these services may cost money.
There is a detailed tutorial on how to install git-bob as GitHub action to your repository. In very short, to use git-bob in your GitHub repository, you need to
.github/workflows/ to your repository.
pip install -e . with a specific git-bob version such as pip install git-bob==0.16.0.requirements.txt file, remove the line pip install -r requirements.txt.GIT_BOB_LLM_NAME GitHub repository secret. These were tested:
anthropic:claude-3-5-sonnet-20241022openai:gpt-4o-2024-08-06github_models:gpt-4ogithub_models:meta-llama-3.1-405b-instructgoogle:gemini-1.5-pro-002mistral:mistral-large-2411 (uses pixtral-12b-2409 for vision tasks)deepseek:deepseek-chate-infra_cz:llama3.3:latestOPENAI_API_KEY: OpenAI (gpt)ANTHROPIC_API_KEY: Anthropic (claude)GH_MODELS_API_KEY: GitHub Models MarketplaceGOOGLE_API_KEY: Google AIMISTRAL_API_KEY: MistralDEEPSEEK_API_KEY: DeepSeekKISSKI_API_KEY: KISSKIBLABLADOR_API_KEY: BLABLADORE_INFRA_CZ_API_KEY chat.ai.e-infra.cz docsGITHUB_TOKEN.When using it in your repository, you can also set a custom system message, for example for:
Furthermore, to guide discussions, you may want to setup issue templates, e.g.
Since version 0.10.1 git-bob has experimental support for gitlab. You find detailed instructions how to install it here.
To trigger git-bob, you need to comment on an issue or pull request with the comment trigger word (or aliases think about, review, respond):
git-bob comment
If you want to ask git-bob for a review of a pull-request, you can use the review trigger word. Also make sure mention explictly what you want to be reviewed.
git-bob review this PR. Check code quality and comments.
After some back-and-forth discussion, you can also use the solve trigger word (or aliases implement, apply) make git-bob solve an issue and send a pull-request.
This trigger can also be used to modify code in pull requests.
git-bob solve
You can ask git-bob to implement a solution for testing, without sending a pull-request, using the try trigger:
git-bob try
If you have multiple API-Key for different LLMs configured, you can specify the LLM in the command using the ask <LLM-Name> to trigger command:
git-bob ask claude-3-5-sonnet-20241022 to solve this issue.
If the issue is complex and should be split into sub-issues, you can use the following command:
git-bob split
If you have two GitHub secrets TWINE_USERNAME and TWINE_PASSWORD configured, you can also use the following command to publish a new version of your library to PyPI:
git-bob deploy
All trigger words can be combined with please and/or ,, which will make no difference to calling git-bob without these words:
git-bob, please ask gemini-1.5-pro-002 to solve this issue.
Here's the recommended workflow for using git-bob:
git-bob comment, or git-bob think about this (an alias for comment) to trigger git-bob making a plan.git-bob solve or git-bob implement this (an alias for solve) to trigger git-bob.Git-bob can interact with a variety of file formats.
A huge variety of use-cases for git-bob are thinkable. Here are some examples. Many serve purely demonstrative purposes. Some were parts of real scientific data analysis projects.
git-bob refusing to help
git clone https://github.com/haesleinhuepf/git-bob.git
cd git-bob
You can also install git-bob locally and run it from the terminal.
In this case, create a GitHub token and store it in an environment variable named GITHUB_API_KEY.
Also create an environment variable GIT_BOB_LLM_NAME with the name of the LLM you want to use, e.g. "gpt-4o-2024-05-13" or "claude-3-5-sonnet-20241022" or "github_models:gpt-4o".
Then you can install git-bob using pip:
pip install git-bob
You can then use git-bob from the terminal on repositories you have read/write access to. It is recommended to call it from the root folder of the repository you want to interact with.
git clone https://github.com/<organization>/<repository>
cd <repository>
git-bob <action> <organization>/<repository> <issue-number>
Available actions:
review-pull-requestcomment-on-issuesolve-issuesplit-issuegit-bob is a research project and has limitations. It serves as basis for discussion and further development. Once LLMs become better, git-bob will become better as well.
At the moment, these limitations can be observed:
git-bob was tested for Python projects mostly. It seems to be able to process Java and C++ as well.gpt-4o-2024-08-06). When using OpenAI's models it combines output of multiple requests to a maximum file length about 64k tokens. It may then miss some spaces or a line break where responses were stitched.
When using GitHub models, the maximum file length is 4k tokens. When using Anthropic's Claude, the maximum file length is 8k tokens.git-bob is incompatible with locally running open-source/-weight LLMs.
This might make sense when being executed locally only. In the GitHub-CI this might be impossible.claude-3-5-sonnet-20241022, gpt-4o-2024-08-06, github_models:gpt-4o, github_models:meta-llama-3.1-405b-instruct and gemini-1.5-pro-002 produced useful results.git-bob is not allowed to modify workflow files, because it also uses GitHub workflows.git-bob can be extended in multiple ways. All you need to do is to set up small python library which implements specific functions and exposes them using Pythons plugin system. You find an example implementation of the extensions described below in this respository.
If you want to add new trigger words and corresponding python functions, you can do so by implementing a new trigger handler function with a predefined signature in a small python library.
The function can have the arguments repository, issue, prompt_function and base_branch and if you do not need all of them, just leave them out and add **kwargs at the end of the argument list.
E.g. if you want to add a new trigger word love, you can implement a new function like this.
def love_github_issue(repository, issue, **kwargs):
from git_bob._utilities import Config
Config.git_utilities.add_comment(repository, issue, "I love this issue! <3")
Additionally, you need to configure your plugin's entry point in its setup.cfg file:
git_bob.triggers =
love = my_library.my_python_file:love_github_issue
If you use institutional LLM-servers which are accessible from the internet (or from your gitlab-server), you can use them using git-bob by implementing a new prompt handler function with a predefined signature.
E.g. if your LLM-server is openai-compatible, you can reuse the prompt_openai function, adjust parameters such as max_response_tokens, and the url of your LLM-server like this:
def prompt_my_custom_llm(message: str, model=None, image=None):
import os
from git_bob._endpoints import prompt_openai
model = model.replace("my_custom_llm:", "")
return prompt_openai(message,
model=model,
image=image,
base_url="https://my_server/v1",
api_key=os.environ.get("MY_CUSTOM_API_KEY"),
max_response_tokens=8192)
Additionally, you need to configure your plugin's entry point in its setup.cfg file:
git_bob.prompt_handlers =
my_custom_llm = my_library.my_python_file:prompt_my_custom_llm
git-bob will then detect your plugin and can use it if the GIT_BOB_LLM_NAME secret is set to any model containing my_custom_llm.
You could for example configure a llama model running on your LLM-server like this: my_custom_llm:llama3.3-70b.
If you wish to extend git-bob with custom triggers or prompt handlers, but avoid default triggers and prompt handlers, you can configure a filter in the git-bob.yml workflow file.
Just overwrite this default regular expression accepting all extensions:
GIT_BOB_EXTENSIONS_FILTER_REGEXP: ".*"
If you want to only accept extensions starting with my_library, you can configure the filter like this:
GIT_BOB_EXTENSIONS_FILTER_REGEXP: "^my_library.*"
If you want to accept all extensions but not git-bob`s defaults, you can configure the filter like this:
GIT_BOB_EXTENSIONS_FILTER_REGEXP: "^(?!git_bob).*"
There are similar projects out there
Feedback and contributions are welcome! Just open an issue and let's discuss before you send a pull request. A human will respond and comment on your ideas!
If you use git-bob, please cite it:
@misc{haase_2024_13928832,
author = {Haase, Robert},
title = {{Towards Transparency and Knowledge Exchange in AI-
assisted Data Analysis Code Generation}},
month = mar,
year = 2025,
publisher = {Nature Computational Science},
doi = {10.1038/s43588-025-00781-1},
url = {https://doi.org/10.1038/s43588-025-00781-1}
}
We acknowledge the financial support by the Federal Ministry of Education and Research of Germany and by Sächsische Staatsministerium für Wissenschaft, Kultur und Tourismus in the programme Center of Excellence for AI-research „Center for Scalable Data Analytics and Artificial Intelligence Dresden/Leipzig", project identification number: ScaDS.AI
FAQs
git-bob uses AI to solve Github-issues. It runs inside the Github CI, no need to install anything on your computer.
We found that git-bob demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An impersonated golang.org/x/crypto clone exfiltrates passwords, executes a remote shell stager, and delivers a Rekoobe backdoor on Linux.

Security News
npm rolls out a package release cooldown and scalable trusted publishing updates as ecosystem adoption of install safeguards grows.

Security News
AI agents are writing more code than ever, and that's creating new supply chain risks. Feross joins the Risky Business Podcast to break down what that means for open source security.