agentic-actions-auditor

Allowlisting by command name (e.g., permitting 'echo' only) is unsafe if the runtime invokes that command through a shell that performs subshell/backtick/process-substitution expansion. Confirmed PoCs against Gemini CLI demonstrate practical RCE and secret exfiltration. Mitigations: avoid shell execution of allowlisted commands (use exec with argv arrays), perform strict argument validation or structured command APIs, and minimize secrets in execution environments. Platforms with direct exec semantics are not vulnerable; confirm runtime behavior before assuming safety.

This is a credible, high-impact supply-chain configuration vulnerability: attacker-controlled GitHub event fields can be placed into environment variables and then referenced by AI prompts without visible '${{ }}' interpolation, enabling silent prompt injection and downstream misuse. The artifact is not intrinsic malware but facilitates attacker influence over AI context and CI actions. Projects using AI actions and workflows should audit env: assignments and prompt texts, block or sanitize any github.event.* values sent to AI agents, and enforce stricter controls for workflows triggered by external input.

The provided text is a clear, accurate description of a high-risk GitHub Actions misconfiguration: embedding `${{ github.event.* }}` directly into AI prompt fields leads to YAML-time injection of attacker-controlled text into prompts. The artifact itself contains no executable malicious code, credentials, or obfuscation, but highlights a real supply-chain risk that can enable prompt injection, data leakage, or unauthorized downstream actions when present in workflows. Workflows should be audited for `${{ github.event.* }}` occurrences in AI `with:` fields and remediated by sanitization, runtime retrieval with validation, or privilege minimization.

This document describes a real and credible supply-chain attack vector (Vector E) that enables prompt injection via attacker-controlled CI/build/test logs passed into AI-driven workflow steps. The artifact itself is not malicious code, but it identifies a vulnerability pattern that can be exploited when workflows interpolate raw CI output into AI prompts (e.g., via ${{ github.event.inputs.error_logs }} or ${{ steps.*.outputs.* }}). Projects that feed full build/test logs into AI actions to 'fix' failures are at significant risk and should sanitize, limit, or avoid passing untrusted logs into prompts and should restrict what automated AI actions can commit or run.