self-hosted-macos-runner
Fail
Audited by Gen Agent Trust Hub on Nov 11, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCEPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Downloads the official GitHub Actions runner release binary from GitHub's repositories. This targets a well-known service and is a core part of the runner setup process.\n- [COMMAND_EXECUTION]: Executes a local Python script via a shell pipe to parse JSON metadata retrieved from the GitHub API. This is used to dynamically identify the latest runner version.\n- [PERSISTENCE]: Installs a LaunchAgent into the user's Library folder (
~/Library/LaunchAgents) to ensure the GitHub runner process starts automatically upon user login.\n- [PRIVILEGE_ESCALATION]: Usessudoto perform administrative tasks required for macOS CI/CD, such as selecting the active Xcode version, accepting licenses, and disabling system sleep.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface where repository variables or tokens provided by a user could influence the agent's actions if they contained malicious instructions. The skill remediates this risk by recommending private repositories and strict runner group access controls.\n - Ingestion points:
SKILL.md(interpolation ofvars.MACOS_RUNS_ON),scripts/install-runners.sh(reading ofRUNNER_TOKEN).\n - Boundary markers: Not explicitly present in workflow snippets; relies on platform-level variable isolation.\n
- Capability inventory: Performs network requests, executes shell commands, installs services, and manages system settings via
sudo.\n - Sanitization: Relies on the security of the GitHub platform's secret management and advises users on safe practices.
Recommendations
- HIGH: Downloads and executes remote code from: https://api.github.com/repos/actions/runner/releases/latest - DO NOT USE without thorough review
Audit Metadata