awf-skill

No explicit malicious payload is visible in the provided fragment (no clear network exfiltration to unknown domains, no reverse shell, no hardcoded credentials). However, the workflow has multiple high-risk supply-chain/abuse primitives: execution of dynamically loaded scripts from runner temp, broad agent capabilities (allow-all-tools/paths), propagation of GitHub tokens into containerized MCP services, persistent cache-memory influencing behavior across runs, and mounting the host Docker socket into a container. This combination increases the likelihood that a compromised dependency/artifact/image could be used for sabotage or data theft even if the workflow code itself is not overtly malicious. Recommend tightening: remove docker.sock mount if possible, reduce agent capabilities, validate/lock down artifact provenance, and harden cache-memory trust boundaries.

No clear, direct malicious payload is visible in the provided fragment (no obvious reverse shell/crypto-mining/exfiltration to unknown domains). However, the workflow grants highly sensitive capabilities: it runs Codex with --dangerously-bypass-approvals-and-sandbox and mounts the host Docker socket into a container. That combination greatly increases the blast radius if any invoked script, bundled code, or npm dependency is compromised. Treat this as a high operational-risk artifact and inspect the referenced ${RUNNER_TEMP}/gh-aw/actions/* scripts/bundles and the npm lockfiles/provenance for supply-chain integrity.

No direct, explicit malware is visible in this snippet (no obvious backdoor code, suspicious domains, or overt data-exfiltration routines). However, it runs an LLM agent with very broad capabilities (--allow-all-tools, --allow-all-paths), injects powerful GitHub tokens into that execution environment, and persists cross-run cache-memory with git-based updates. This combination is a significant supply-chain/agent-compromise risk and should be reviewed for dependency integrity, pinning, and strict sandboxing/egress controls. Confidence is limited because key referenced scripts/binaries (copilot_harness.cjs, awf, threat-detect, install scripts, and git cache scripts) are not included.

No direct, explicit malicious code (e.g., reverse shells, obvious data exfiltration to unknown domains, hardcoded credentials) is visible in the provided fragment. However, the orchestration is high-risk from a supply-chain/agent-execution standpoint: it executes multiple locally staged scripts from runner temp, passes sensitive tokens to an AI agent harness, grants very broad tool/path permissions, and mounts shared directories as writable. If any upstream artifact (downloaded scripts/bundles/images) is compromised, this design would enable rapid arbitrary-code execution and potentially sensitive data misuse. Overall: treat as a security alert for dependency/supply-chain integrity and runtime policy enforcement, even though malware is not directly evidenced in the shown snippet.

No direct, explicit malware is visible in this fragment (no clear exfiltration domain, reverse shell, cryptomining, or hardcoded payload). However, the code passes secrets into dynamically executed agent harnesses (via --env-all and explicit token env vars), runs local scripts loaded from ${RUNNER_TEMP}/gh-aw/actions, and grants broad permissions to the agent (--allow-all-tools/--allow-all-paths) while using writable host mounts (/tmp/gh-aw:rw). This combination creates a high-impact risk if any referenced component is compromised. Confidence is limited because the actual dependency code/binaries and local .cjs scripts are not included here.

No clear, explicit malware payload is visible in the provided fragment, but the workflow executes a highly capable agent with an explicit sandbox/approval bypass flag (--dangerously-bypass-approvals-and-sandbox) while injecting and mounting sensitive runtime material (including secrets and read-write mounts of /tmp/gh-aw). This creates a high-risk supply-chain/CI execution environment where malicious or compromised agent/helpers could access secrets and perform unauthorized actions. Review and pin/audit the referenced ${RUNNER_TEMP}/gh-aw/actions/*.cjs and shell scripts and remove or tightly gate the sandbox-bypass behavior.

No clear, direct malicious code is visible in the provided fragment. However, the workflow grants the agent extremely broad capabilities (--allow-all-tools, --allow-all-paths) and mounts writable host-like directories into the execution environment, and it copies session-state into logs that are uploaded as artifacts. Without the contents of the invoked .cjs scripts and harness, the supply-chain threat cannot be fully ruled out; the configuration itself is high-risk and could facilitate sabotage if any dependency is malicious.

No direct, explicit malware code is shown in this fragment. However, the workflow performs high-risk supply-chain-sensitive operations: dynamic execution of local Node scripts from runner.temp, launching containers that mount the host Docker socket, passing GitHub tokens into the runtime/MCP servers, and running an agent with permissive tool/path flags (mitigated by separate firewall/policy layers that are not fully verifiable from the snippet). Given the truncated nature and missing contents of the referenced .cjs and .sh files, treat this as a medium-to-high security review item: verify integrity/pinning of the setup/start scripts, container image digests, and enforce that “allow-all-tools/paths” is truly constrained by the firewall/safe outputs policy.

No clear, direct malware payload is visible in the provided fragment. The dominant finding is architectural risk: a powerful LLM agent/harness is executed with explicit sandbox/approval bypass flags and a read-write mount into runtime-accessible temp space, while sensitive API keys are supplied via environment variables and agent-controlled outputs are later parsed to drive GitHub write actions. This combination substantially increases the impact of any compromise or malicious behavior in the referenced harness/scripts, even though the snippet alone doesn’t prove malicious intent.

No direct evidence of classic malware (eval-based injection, reverse shells, credential harvesting in plaintext, obvious exfil to attacker domains) is present in the provided fragment. However, the workflow executes an LLM-driven agent with filesystem write/edit capabilities and starts a Docker-based MCP gateway that mounts the Docker socket and passes powerful GitHub/LLM tokens into containerized services. Since many critical behaviors are delegated to external `gh-aw` scripts and container images not included here, supply-chain risk remains medium: a compromised dependency/script/container could abuse these high-privilege execution paths or token access despite apparent firewall/safe-output guardrails.

No direct evidence of classic malware (reverse shell, cryptomining, explicit exfiltration) is visible in the provided fragment alone. However, the workflow executes locally staged Node modules from RUNNER_TEMP using sudo and starts an agent with --allow-all-tools and --allow-all-paths, which substantially increases the consequences of any supply-chain compromise in the harness/actions code. Additionally, it copies session state into logs and uploads multiple artifacts, increasing confidentiality exposure. This should be reviewed at the harness and action .cjs script level to confirm they are not performing unauthorized network/file actions. Confidence is limited because the actual executable code called here is not included.

No direct, explicit malware payload is visible in the provided snippet. However, the workflow is operationally high-risk: it runs an agent with “--dangerously-bypass-approvals-and-sandbox” and it mounts the host Docker socket into a containerized MCP gateway. These patterns substantially increase the impact of any compromised dependency/tool, misconfiguration, or malicious behavior in invoked scripts. Treat this workflow and its dependencies as requiring strict integrity verification and sandboxing review; audit the referenced scripts and the npm-installed packages (including @openai/codex and the AWF dependency tree) to confirm they cannot perform unauthorized actions.

No direct evidence of classic malware (exfiltration to unknown domains, backdoor installation, crypto-mining, or explicit shellcode) is present in this fragment. However, the workflow grants the agent significant power: it mounts the host Docker socket into a container and runs Codex with `--dangerously-bypass-approvals-and-sandbox` and `--skip-git-repo-check`. Because the actual logic resides in external generated scripts and container images not included here, the safest interpretation is medium security risk due to high privilege and safety bypass, not confirmed malicious behavior.

No definitive malware/backdoor/exfiltration logic is visible in the provided workflow snippet, but the workflow has elevated security impact: it passes multiple secrets into containerized MCP components and mounts the host Docker socket into the MCP gateway container. Combined with agent execution flags (--allow-all-tools/--allow-all-paths) and reliance on many external runner-temp scripts (contents not provided), the sandbox boundary becomes the primary risk area. Overall, this should be reviewed for isolation correctness and for any malicious logic inside the referenced scripts/containers.

No direct, explicit malicious code is visible in this fragment (no clear backdoor/exfil domain/IP, no eval/Function obfuscation, no destructive actions). However, the workflow materially increases supply-chain/agent-abuse risk: it runs an agent with --allow-all-tools and --allow-all-paths, injects GitHub tokens into containerized MCP servers, uses OTLP telemetry with configurable headers/endpoints, and constructs a docker run command that mounts the Docker socket. If any referenced component (gh-aw npm build output, dynamically required scripts in RUNNER_TEMP, or the pinned ghcr.io container images) were compromised, the blast radius could be high. Recommend reviewing the referenced scripts (under ${RUNNER_TEMP}/gh-aw/actions/*), the npm package source being built, and the container image layers for unexpected network/file/process behavior. Overall: suspicious risk posture, but no definitive malware evidence from the provided fragment alone.

No direct, visible evidence of explicit malware (e.g., reverse shell, hardcoded exfil endpoints, credential dumping, or obfuscated payloads) appears in the provided fragment. However, it launches an agent harness with broad permissions (allow-all tools/paths) and runs multiple executable scripts from ${RUNNER_TEMP}/gh-aw/actions/* with env-all, plus it copies session state into logs/artifacts. This combination increases supply-chain/agent-compromise risk substantially. Because the contents of the executed scripts (copilot_harness.cjs, patch_awf_chroot_config.cjs, etc.) are not provided, the analysis cannot definitively rule out malicious behavior residing in those dependencies/assets.

No explicit malicious payload is visible in this fragment (no obvious reverse shell/crypto-mining/eval-based injection/exfiltration to unknown domains). However, the workflow executes multiple local Node/.cjs modules and an agent harness with highly permissive flags (--allow-all-tools, --allow-all-paths, --env-all) and copies session state into logs (then attempts redaction). Because the called .cjs/bash modules are not included (truncated snippet) and are likely where real behavior resides, malware/sabotage cannot be conclusively ruled out. Recommend reviewing the referenced runner-temp scripts and the awf/harness/tools they invoke, and verifying redaction completeness.

No clear evidence of direct malware (reverse shells, hardcoded exfiltration, or explicit credential theft) is present in this fragment. The security concern is elevated risk-by-design: it executes an agent harness with permissive tool/path/environment capabilities, injects GitHub tokens into the harness runtime, dynamically extends PATH from a tool cache, and uploads extensive logs/artifacts including copied session-state. If any of the invoked local modules/scripts or their dependencies are tampered with, the blast radius could be significant. Priorities: verify provenance/integrity of the runner-temp scripts/modules and the tool cache contents; confirm redaction completeness for all uploaded session-state/log data; and reduce/justify permissive agent flags in CI.

No clear, explicit malware behavior (e.g., hardcoded exfiltration targets, reverse shells, or file-destruction commands) is present in the provided fragment. However, the workflow executes runtime code from temp directories and grants the agent extensive shell execution capabilities (including cat/git/grep/node/etc.) while mounting /tmp/gh-aw read-write into the execution environment. This creates a high-impact risk if any referenced harness/scripts or their npm dependencies are compromised, or if the agent can be induced to misuse granted shell tools. Additional review is needed for the specific ${RUNNER_TEMP}/gh-aw/actions/*.cjs and associated npm packages.

No clear, direct evidence of overt malware (e.g., reverse shell, hardcoded credential theft, or explicit suspicious exfiltration endpoints) is visible in the provided fragment. However, the workflow performs high-impact dynamic execution: it runs Node.js “actions” modules from a runtime-populated directory, modifies PATH based on discovered cache bins, and starts an agent with broad capability flags (--allow-all-tools/--allow-all-paths). Given the snippet is truncated and the actual implementations of the referenced scripts are not shown, the supply-chain/malicious-sabotage risk cannot be fully discounted; it should be reviewed in the referenced setup/run and .cjs/bash files for hidden network/file/process behavior.

No explicit malware payload is visible in the provided fragment (no clear reverse shell, eval/obfuscated dropper, or hardcoded secrets). However, the workflow executes a powerful agent harness with --allow-all-tools and --allow-all-paths, runs multiple dynamically loaded local scripts from ${RUNNER_TEMP}/gh-aw/actions and uploads/copied session state and logs from /tmp/gh-aw. This combination creates a substantial supply-chain/CI sabotage and data-exfiltration risk if any downloaded helper script or the harness is compromised, even though the snippet itself does not prove malicious intent.

No explicit malicious code (e.g., hardcoded credentials, obvious backdoor/reverse shell, direct exfiltration to attacker domains) is visible in this fragment. However, the agent harness is invoked with broad execution capabilities (shell(...) tools, web_fetch, and write with --allow-all-paths) and the workflow uses sudo/containerized hypervisor execution. This combination is a high-importance risk surface: if the sandbox/firewall or safe-output enforcement is flawed (in scripts not shown here), the agent could potentially run harmful commands or leak data. Due to truncation and missing referenced script contents, malware presence cannot be confirmed—only a meaningful security risk is indicated.

No explicit malicious payload (reverse shell, cryptomining, hardcoded malicious exfiltration) is present in the provided fragment. The primary security concern is supply-chain/execution trust: the workflow executes Node/CommonJS scripts from RUNNER_TEMP and runs an agent harness with very permissive capabilities (--allow-all-tools/--allow-all-paths) while providing sensitive tokens to the harness. If any of the executed scripts or prompt/config inputs are compromised, the blast radius would be significant. Additional visibility into the contents of the invoked .cjs/bash files is required for higher-confidence malware determination.

No explicit malware is visible in the provided fragment (no obvious hardcoded secrets, obfuscated payloads, reverse shells, or direct suspicious network destinations). However, the workflow executes an LLM agent with broad capabilities (--allow-all-tools/--allow-all-paths) and mounts Docker socket access into an MCP gateway container, creating a high-blast-radius environment if any upstream component (downloaded scripts under $RUNNER_TEMP/gh-aw/actions or npm-built awf dependencies) were compromised. Also, npm ci/build is a supply-chain execution sink, but dependency details are not included here. Overall: structural risk is elevated; malware presence cannot be confirmed from this fragment alone.

No direct evidence of classic supply-chain malware (backdoor, reverse shell, explicit exfiltration) is present in the shown fragment. However, the workflow executes dynamically-loaded local modules from $RUNNER_TEMP and runs a Copilot agent harness with --allow-all-tools and --allow-all-paths while mounting broad host directories into containers. This creates a high-impact risk surface if an attacker can tamper with runner temp contents, PR code, or cache-memory. Treat this as a medium security-risk supply-chain/agentic-execution design concern rather than confirmed malicious code; more context (the referenced *.cjs/*.sh files and npm dependency lockfiles) is needed for higher confidence.

No clear, self-contained malware/backdoor is present in this workflow fragment. However, it is a highly sensitive red-team orchestration that executes externally fetched tooling (curl|sh, npm installs/builds, git clone) with multiple secrets and it mounts the Docker socket into a container (risk amplifier). The explicit attempt-oriented exfiltration testing logic further increases the chance of harmful side effects if any component is compromised. Treat as medium security risk for supply-chain/sabotage concerns; verify integrity of all downloaded/executed components (npm/uv/git, and gh-aw actions scripts not included here).

No explicit malicious logic (e.g., reverse shell, destructive file ops, obvious network exfiltration, cryptomining) is present in the provided fragment. However, it executes an agent harness with GitHub tokens and broad permissions (--allow-all-tools/--allow-all-paths) and runs multiple local Node scripts from ${RUNNER_TEMP}/gh-aw/**; since the referenced harness/scripts are not included and the snippet is truncated, the primary concern is potential supply-chain/agent abuse if any of those temp scripts/dependencies are tampered with. Redaction and output-validation steps exist, which is a mitigating control, but execution-with-tokens remains a high-risk pattern.

No direct evidence of malware (e.g., eval-based payloads, obfuscated exfiltration, reverse shells, or destructive file operations) is visible in this workflow fragment. However, the workflow has elevated security impact pathways: it mounts the host Docker socket into a container used for the MCP gateway, grants the agent broad capability flags (--allow-all-tools/--allow-all-paths), and executes many dynamically obtained scripts under ${RUNNER_TEMP}/gh-aw/actions/. Without inspecting those external scripts/dependencies and the pinned container contents, the fragment presents a medium supply-chain/escape risk rather than high-confidence malware.

No direct evidence of malware (e.g., hardcoded secrets, reverse shells, or exfiltration to suspicious domains) is present in the visible fragment. The main security concern is an intentionally permissive agent execution surface: the harness enables shell(...) tool calls and mounts /tmp/gh-aw into the runtime with read-write access, plus it executes staged local scripts under $RUNNER_TEMP/gh-aw/actions/*.cjs. Because those referenced scripts are not included here, the true risk depends on their contents and integrity earlier in the workflow. Treat this as a medium risk orchestration pattern requiring verification of staged script provenance and tool/inputs constraints.

No direct evidence of classic malware (exfiltration to suspicious domains, reverse shell, cryptomining, hardcoded secrets) is present in this fragment. However, the workflow configures a highly privileged agent execution path (`--allow-all-tools --allow-all-paths`) and starts an MCP gateway container with the host Docker socket mounted, which is a powerful capability that could enable host-level compromise if isolation is bypassed. Because the fragment executes many scripts from `${RUNNER_TEMP}/gh-aw/actions` and relies on `npm ci`/`npm run build` outputs (not shown), the primary supply-chain risk is in those external dependencies/components. Overall: suspicious/high-risk configuration rather than confirmed malicious code in this snippet.

No direct evidence of classic malware behaviors (exfiltration to unknown domains, reverse shells, cryptomining, hardcoded credentials, or explicit eval/Function-based code execution) is present in the provided fragment. However, the workflow executes an agent with high capabilities (docker.sock mount, RW mounts to /tmp and workspace, and permissive flags for tools/paths) and passes GitHub tokens into MCP containers. This combination makes the system high-risk if any upstream dependency/image/script or mounted cache content is compromised. Confidence is limited because the actual runtime Node scripts and npm package code are not included in this snippet.

No definitive malware (e.g., reverse shell, cryptomining, hardcoded credential theft, or explicit exfiltration to attacker domains) is present in the shown fragment. However, the workflow grants substantial power by mounting the host Docker socket into a container that runs the MCP gateway, and the agent is executed with broad allowances (--allow-all-tools, --allow-all-paths) within a complex harness. Without reviewing the invoked scripts (start_mcp_gateway.cjs, safeoutputs startup scripts, copilot_harness.cjs, and other ${RUNNER_TEMP}/gh-aw/actions/*.cjs/.sh), there is a medium suspicion of abuse potential rather than proven maliciousness.

No direct evidence of explicit malware (e.g., reverse shell/crypto-mining/exfiltration to unknown domains) is visible in the provided fragment. However, the workflow performs elevated, agentic execution with powerful flags (allow-all-tools/allow-all-paths), runs with development allowance for unattested artifacts, and dynamically executes local JS modules from ${RUNNER_TEMP}/gh-aw/actions using require(). If that directory’s contents are compromised, the workflow would likely execute attacker-controlled code with GitHub tokens—making this a medium-to-high supply-chain risk area that warrants deeper review of the referenced local scripts/harness modules and how ${RUNNER_TEMP}/gh-aw/actions is populated.

No explicit malware code (e.g., reverse shell, obvious exfil to a suspicious domain, eval/Function payloads, or destructive file operations) is visible in the provided snippet. However, the workflow configures and runs an LLM/agent harness with very broad capabilities (--allow-all-tools, --allow-all-paths, --env-all, and mounting the workspace) and repeatedly executes locally stored JS modules from RUNNER_TEMP/gh-aw/actions. Because those modules and the harness implementation are not shown, the supply-chain integrity of the executed code cannot be confirmed here. The workflow also persists and commits cache-memory content, which can create a durable channel for instruction/prompt manipulation if an attacker can influence cached data. Overall: elevated security/supply-chain risk, with malware intent unproven from this fragment alone.

No direct malicious payload is visible in this fragment, but it performs high-risk agent execution: it runs Node/CLI harness code from runner temp with broad capabilities ("--allow-all-tools" and "--allow-all-paths"), writable mounts (/tmp/gh-aw rw), and injects multiple GitHub-related tokens into the runtime. If the referenced harness/scripts/config are malicious or compromised, this setup could enable credential misuse and unauthorized actions. Given the missing code for the referenced scripts, treat this as a medium-to-high supply-chain risk and verify the integrity/audit of the harness and all ${RUNNER_TEMP}/gh-aw/actions/*.cjs and .sh files.

No direct evidence of explicit data theft/cryptomining/backdoor behavior is present in the provided fragment. However, the workflow exhibits multiple high-impact supply-chain and isolation-risk patterns: dynamic execution of JS modules from runner temp directories (dependent on downloaded artifacts), mounting the host Docker socket into a container, passing GitHub tokens into MCP server containers, and running the agent with broad flags (--allow-all-tools/--allow-all-paths, --build-local). If any upstream artifact/container/script is compromised, these provide strong primitives for malicious action. This warrants deeper review of the referenced local scripts (under RUNNER_TEMP/gh-aw/actions) and the Docker images/entrypoints used for MCP servers and safe outputs.

No clear direct malware is visible in the provided fragment (no obvious reverse shell/crypto-mining/exfiltration domains, and no explicit eval/Function). However, the workflow executes a powerful agent harness with broad tool and path permissions (--allow-all-tools/--allow-all-paths) and writable mounts (/tmp/gh-aw as :rw), and dynamically loads multiple Node scripts from ${RUNNER_TEMP}/gh-aw/actions/. This significantly increases the impact of any upstream supply-chain compromise of those scripts/harnesses. Treat as medium security risk and review the underlying cjs/bash scripts and the setup action content for malicious behavior.

No clear, explicit supply-chain malware is shown in the provided fragment. However, it dynamically executes multiple runner-local scripts and starts an agent with highly permissive flags (--allow-all-tools, --allow-all-paths). It also copies session-state into logs and uploads many artifacts. Because the actual contents of the local .cjs and shell scripts are not included here, confidence is limited; the fragment presents elevated security/abuse potential rather than direct evidence of malicious payloads.

The provided fragment does not show overt malware (no clear exfil-to-external domains or backdoor mechanics in the visible lines). The primary security concern is a high-impact trust boundary: the workflow dynamically stages and executes multiple local .cjs/.sh modules from a runner-temporary directory (populated by another action) while injecting GitHub/MCP tokens and running the agent with permissive tool/path allowances and writable mounts. If any staged component is compromised or altered, it could execute with significant CI/GitHub reporting privileges. Additional medium risk exists for potential residual sensitive data exposure via log/session-state copying and artifact uploads, despite an attempted redaction step.

No direct malware indicators are visible in this fragment (no reverse shell, no explicit credential exfiltration code, no eval/Function/backdoor). However, the workflow dynamically executes staged scripts from runner temp, runs an agent with permissive capability flags, and passes GitHub tokens into containerized MCP servers while mounting broad filesystem paths. This creates a meaningful supply-chain/sandbox-escape risk if any referenced scripts or Docker images/artifacts are tampered with. Verify provenance, pinning, artifact integrity checks, and sandbox boundaries.

No clear, direct malware indicators are visible in this fragment (no explicit eval/backdoor/network exfiltration to unknown domains). However, the workflow dynamically executes staged code from `${RUNNER_TEMP}/gh-aw/actions/*.cjs` and passes secrets plus repository workspace into an agent harness, then copies session-state into logs and uploads many artifacts. That combination represents a high-value supply-chain boundary and potential sensitive-data leakage risk if redaction/session-state handling is incomplete. The actual presence/absence of sabotage cannot be confirmed without the referenced scripts (copilot_harness.cjs, run_awf_with_startup_retries.sh, redaction and parsing modules).

No explicit malware/backdoor/exfiltration code is visible in the provided fragment. However, the workflow launches a highly privileged agent harness with permissive flags (--allow-all-tools, --allow-all-paths) and passes sensitive GitHub/MCP tokens into the runtime, while also mounting writable directories and copying session state into logs/artifacts. This creates a significant security risk if any upstream script/files (copilot_harness.cjs / .sh) or cache-memory content can be tampered with. Recommend verifying integrity/signatures of the scripts copied into RUNNER_TEMP, tightening tool/path permissions, reducing writable mounts, and ensuring complete secret redaction of session state and uploaded artifacts.

No explicit malware/backdoor is directly visible in the provided fragment (no clear hardcoded exfil endpoints or reverse shell patterns). However, the workflow grants a powerful agent harness shell tool capability including write, broad filesystem access (including the workspace), injects multiple high-value tokens into that execution context, and copies session-state/logs into shared temp directories that are later uploaded and processed. This combination creates a significant supply-chain and data-leak risk if any of the executed local scripts/modules (or the setup/provisioning step that places them under RUNNER_TEMP) were compromised. Review and verify the provenance/integrity of the referenced runner-temp modules, and validate that redaction reliably covers session-state and logs before artifacts are published.

No direct evidence of overt malware is present in the shown fragment (no explicit exfiltration endpoints or backdoor mechanics), but it executes locally staged scripts and grants the agent unusually broad capabilities (shell tool allowlist + write + --allow-all-paths, with a writable mount /tmp/gh-aw). This creates a high-impact trust boundary: if the staged harness/scripts were tampered with, sabotage/data exposure could occur. Review the setup action and all ${RUNNER_TEMP}/gh-aw/actions/*.cjs and copilot_harness.cjs contents and verify redaction correctness before trusting the artifact/log outputs.

No direct, explicit malicious payload is visible in the provided workflow fragment. However, the workflow has substantial supply-chain and execution-risk characteristics: it runs npm install/build and executes resulting artifacts, uses secret-bearing MCP/GitHub integrations, runs a containerized MCP gateway with broad filesystem mounts, and invokes the agent harness with --allow-all-tools and --allow-all-paths. These are not proof of sabotage, but they are meaningful risk signals that warrant deeper inspection of the npm lockfile, package integrity, and the unshown scripts/components referenced by the workflow.

No direct malicious payload (reverse shell, credential harvesting code, hardcoded keys, obfuscated embedded malware) is visible in the provided snippet. However, the workflow executes a powerful agent/harness with highly permissive flags (allow-all-tools, allow-all-paths), mounts a writable shared directory (/tmp/gh-aw:rw), passes sensitive GitHub tokens into the execution environment, and dynamically requires and runs multiple local .cjs scripts from runner temp paths. This combination is a credible supply-chain/agent-compromise amplification path, so the flagged risk is plausible but cannot be confirmed as outright malware from the fragment alone.

No direct malware payload is visible in this workflow fragment, but it performs high-impact orchestration: it executes numerous downloaded/required scripts, starts Docker containers with broad mounts, and runs an agent harness with permissive flags (allow-all-tools/allow-all-paths) while handling multiple secrets and telemetry. Without inspecting the referenced gh-aw action scripts and npm dependencies, malware/sabotage cannot be ruled out; the primary concern is supply-chain compromise of those executable components rather than anything explicitly malicious in this snippet.

No clear, direct evidence of embedded malware (e.g., obfuscated payloads, reverse shell, explicit exfiltration endpoints) is visible in the provided fragment. However, the workflow grants a powerful agent harness broad capabilities (allow-all-tools, allow-all-paths) and passes GitHub tokens into its runtime with writable mounts to /tmp/gh-aw. Even though later steps attempt to redact secrets, that does not mitigate leakage during the agent run. This should be reviewed as a high-impact execution surface rather than confirmed malicious code.

No explicit evidence of classic malware (e.g., hardcoded backdoors, exfiltration to unknown domains, crypto-mining, reverse shells) is visible in the provided fragment. However, the workflow is a high-impact agent orchestration that dynamically executes code from runner.temp, starts Dockerized MCP services with GitHub tokens, and runs an agent with --allow-all-tools and --allow-all-paths while mounting the workspace and /tmp. If any upstream supply-chain component (actions/setup, activation artifact, npm dependencies, or referenced container images/scripts) is compromised, this could enable arbitrary code execution and malicious GitHub actions. Due to truncation and missing referenced module contents, confidence is limited.

No clear, self-evident malware (e.g., credential stealing code, obfuscated payloads, hardcoded exfil endpoints, or reverse shell logic) appears directly in the provided fragment. However, the workflow orchestrates highly privileged agent execution with broad permissions (--allow-all-tools and --allow-all-paths), passes GitHub tokens into containerized MCP servers, mounts sensitive host paths (including /tmp and the Docker socket), and executes dynamically loaded scripts from downloaded artifacts. This creates a high security-risk posture where malicious behavior could be introduced via compromised artifacts or abuse of the agent/tooling surface. Review the referenced runtime scripts (from runner.temp/gh-aw/actions) and verify artifact integrity/attestation before accepting this workflow.

No direct malware code is visible in the provided fragment, but the workflow exhibits high supply-chain attack surface: dynamic execution of locally required scripts from runner temp paths, installation/build of npm dependencies, Dockerized MCP gateway with the Docker socket mounted, and injection of GitHub tokens into those containers and the agent harness. If any referenced npm dependency, container image, or local /tmp/gh-aw/actions module were compromised, the agent could be used to exfiltrate data or perform unauthorized actions. Review the referenced local .cjs scripts and the npm dependency tree (lockfile) for malicious behavior.

No explicit, overt malware behavior is evident in the provided fragment (no clear reverse shell, hardcoded attacker endpoints, or obfuscated payload). However, the fragment shows a high-blast-radius agent execution posture: broad --env-all plus --allow-all-tools/--allow-all-paths with non-interactive operation, and dynamic execution of locally staged Node/Bash/CJS code from ${RUNNER_TEMP}/gh-aw. It also copies sandbox session-state into logs/artifacts and relies on redaction/parsing steps plus artifact uploads for containment. The dominant risk is supply-chain/compromise amplification and potential secret leakage if staged files or redaction logic are tampered with; additional review is needed of the contents/integrity of ${RUNNER_TEMP}/gh-aw/actions/* and the redaction/collection modules used here.

No direct, explicit malware payload is visible in the provided snippet. However, the workflow launches an agent harness with very broad permissions (--allow-all-tools and --allow-all-paths, --no-ask-user) and mounts writable directories and the workspace while passing GitHub/MCP tokens. This combination is a significant security risk: if the harness/scripts are compromised or behave unexpectedly, the agent can perform wide-ranging actions and potentially leak secrets (mitigated only partially by a redaction step). Review the referenced local modules/scripts (copilot_harness.cjs and the actions/*.cjs/sh scripts) and verify supply-chain integrity (hash pinning, provenance, and contents).

No direct evidence of overt malware (e.g., credential theft, data exfiltration to external hosts, persistence/backdoors, or destructive actions) appears in this excerpt. However, the asserted readiness-probe mechanism uses a drop-and-run workflow: it base64-decodes a JavaScript “bridge” into a temporary /tmp file and launches it with node via shell-constructed commands, then probes a local reflection endpoint. This is a security-sensitive pattern and should be carefully reviewed in the production implementation for input control, command escaping, and bridge-source provenance. The rest of the test expectations emphasize strong defenses around mount allowlisting and credential scrubbing/restoration.

No confirmed malware is evidenced within this fragment itself; it primarily orchestrates GitHub automation and delegates real behavior to companion .cjs modules loaded at runtime. The main security finding is elevated supply-chain risk: dynamically requiring and executing modules from runner.temp with broad GitHub write permissions means that any tampering/compromise of the setup step or downloaded modules could lead to impactful repository manipulation. Overall, treat this as a medium supply-chain risk module orchestration pattern requiring verification of module integrity/provenance and review of the referenced setup and .cjs implementations.

No clear supply-chain malware/backdoor/persistence mechanism is present in this fragment. The code is primarily a network egress enforcement test harness that manipulates iptables and runs an adversarial probing battery. However, it contains credential-theft-like probing (cloud metadata at 169.254.169.254) and direct egress attempts with proxy disabled; if misused outside the intended CI containment-evaluation context, those behaviors could be harmful. Overall, treat as a security-testing/defense-evaluation script with elevated behavioral risk, not as definitive malicious code.

No clear evidence of intentional malware (no backdoor, credential theft, obfuscated payloads, or direct exfiltration) is present in this wrapper code. The primary security risk is behavioral delegation: it spawns /usr/local/bin/copilot with very permissive flags (notably --allow-all-tools and --allow-all-paths) and the prompt instructs execution of shell commands to modify /awf/out. If the engine or its configuration is compromised, this increases the likelihood of unintended file/system actions. Additionally, the module writes a GitHub MCP config containing an Authorization header to disk, which is sensitive but chmodded to 0600.

No direct evidence of explicit malware (e.g., hidden backdoor logic, external data exfiltration, cryptomining, hardcoded secrets, or obfuscated payloads) is present in this fragment. The dominant security concern is that the supervisor listens on a vsock control channel and executes host-provided commands (with provided argv/env/uid/gid) and streams command output back to the host. This is inherently high-privilege and could be malicious only if the trust boundary for the vsock client is compromised; otherwise, it appears to be a functional guest-agent/supervisor pattern with some path containment checks for cwd under the workspace.

This code is an LD_PRELOAD interposer that targets sensitive token environment variables, caches their values in unmanaged memory, unsets them from the environment, and returns the cached pointers to the caller. In this snippet, there is no explicit network/file/process exfiltration, and it appears aligned with defensive anti-exposure behavior. However, it is still security-relevant and potentially abusable: it hooks libc getenv/secure_getenv globally, uses unsafe dlsym+transmute for function pointers, and permanently retains secret data in memory. Overall security risk is moderate due to high-impact interception of secrets, even though overt malware behaviors are not shown here.

This module is primarily a CI/workflow patcher: it reads repository workflow YAML lock files, performs regex/string-based transformations, and injects new runner-executed shell steps. While the JavaScript itself does not perform malicious actions, it materially increases supply-chain risk by embedding high-impact behavior into CI workflows—specifically a curl-to-shell remote installer (`get.docker.com | sh`) plus Docker Hub/sbx login using GitHub secrets and host device permission changes (/dev/kvm). The risk level therefore depends on the intent and trustworthiness of the injected workflow steps and the imported patch functions, but the modification capability and embedded runner commands warrant careful review of resulting workflow diffs before use.

No strong evidence of intentional malware/obfuscation is visible in this snippet. However, this file implements (or is part of) a remote command execution proxy exposed over HTTP (/exec) and returns execution outputs (stdout/stderr/exitCode) to the caller, with additional conditional stderr preview in audit logs. If authentication/authorization, command allowlisting, and secret redaction are not rigorously implemented in the unseen portions, this pattern creates a high likelihood of sensitive data exposure and remote abuse.

This appears to be a legitimate JSON transformation utility (ANSI stripping, tool dropping, and cache/TTL metadata rewriting) with no direct evidence of malware or data exfiltration in the fragment. However, it includes high-impact, unsandboxed extension points: dynamic requiring of a locally resolved module path and direct execution of a caller-supplied customTransform. If an attacker can influence filePath/customTransform (or the configuration that supplies them), this module can become an arbitrary code execution vector.

SUSPICIOUS: the skill's purpose is coherent, but it delegates agent behavior to many external prompt files, allows local override instructions, and conditionally loads another skill. This is not confirmed malware, but the transitive trust and remote-instruction flow create medium security risk for an AI agent skill.

No direct evidence of malware (no obfuscated payloads, hardcoded credentials, or explicit exfiltration code) is present in the provided workflow fragment. However, the workflow is explicitly designed to perform ‘secret digging’ by enumerating environment variables and inspecting processes/memory, and the fragment does not show enforceable guardrails for redaction or for restricting where findings are emitted. Because the core behavior for secret searching and reporting is delegated to imported shared instruction files and the Codex engine/reporting mechanism (not shown), the safest assessment is elevated operational/security risk: potential accidental or unintended disclosure of secrets via logs/artifacts or misuse if imported content or reporting templates are unsafe. Further review of the imported shared files and the engine’s reporting/redaction and egress controls is required to confirm safety.

The fragment shows multiple strong supply-chain/security red flags: (1) the agent runs curl against https://evil.example.com (suspicious external connectivity), (2) squid configuration is injected from a redacted base64 env var directly into /etc/squid/squid.conf, and (3) the agent is highly privileged/unconfined and has extensive host bind mounts, increasing the impact of compromise. Even though the second curl is “|| true”, the outbound request still occurs. Overall, treat this as potentially malicious or at least requiring urgent review of the container images/scripts and the source of AWF_SQUID_CONFIG_B64 and token environment variables.

This fragment does not show explicit malware behavior by itself, but it performs a high-impact supply-chain sensitive operation: it downloads and executes an unpinned installer shell script from an upstream `main` branch and then copies the resulting executable into a downstream location, with authentication tokens available in the environment. Absent integrity verification (hash/signature) and commit/version pinning, this is a credible arbitrary-code-execution risk if the upstream content or branch is compromised.

No direct indicators of intentional malware (e.g., backdoor, persistence, explicit exfiltration, credential theft routines) are present in this module. However, it performs several high-impact security-risk actions: it logs a potentially sensitive local configuration, forwards a GitHub token into a shell-executed command that runs npx (runtime third-party code execution), and uses `spawn` with `shell: true`. Overall, this is a meaningful supply-chain/execution-time and secret-exposure risk pattern, even though the snippet itself does not clearly implement malicious behavior.

The workflow does not show explicit malicious behavior in the YAML itself, but it performs a high-risk supply-chain action: it downloads and executes an external script at runtime using `curl | bash`, sourced from a mutable `main` branch without integrity pinning. This warrants review/mitigation (e.g., pin the installer to a specific commit, add checksum/signature verification, or vendor the installer) before trusting the pipeline.

No explicit malware payload, exfiltration endpoint, hardcoded credentials, or obfuscation is visible in the provided workflow fragment. However, the workflow is explicitly designed to perform secret hunting using bash and relies on an external imported instruction file that determines what data is accessed and how results are handled. Treat this as high dual-use risk: it can plausibly read sensitive secrets from the agent/container and leak them via agent output/logs, and could exfiltrate if the imported logic includes network actions (not verifiable from this snippet).

The snippet is a workspace bootstrapper that (1) copies a seed directory into a working area while preserving symlinks, (2) redirects output via a symlink, and then (3) executes a fixed Python entrypoint using runpy. The wrapper itself shows no direct exfiltration or credential theft, but the combination of symlink-preserving filesystem setup plus immediate dynamic execution creates a plausible supply-chain/sabotage path if the seed directory or the executed script is not fully trusted. Review/validate /awf/seed (especially symlink targets) and inspect /awf/query-script.py to confirm no malicious filesystem access, data exfiltration, or destructive behavior occurs.