ci-agent-hardening

CI Agent Hardening

Audit and fix security vulnerabilities in GitHub Actions workflows, with emphasis on AI-powered CI/CD. Based on two major 2026 incidents:

• Clinejection — Prompt injection in AI triage bot led to cache poisoning, credential theft, malicious npm publish (~4,000 developers affected)
• hackerbot-claw — Autonomous AI bot exploited 7 repos (Microsoft, DataDog, CNCF, Aqua Trivy), achieving full repo compromise on Trivy (25k+ stars) via PAT theft

Prerequisites

• Repository with .github/workflows/ directory
• bash available for running the audit script

Instructions

For background and exploit details on any pattern below, see references/ATTACK-PATTERNS.md.

Step 1: Run the Automated Audit

Run from the repository root:

bash <skill-path>/scripts/audit-workflows.sh .github/workflows

Review [CRIT] findings first (exploitable now), then [WARN] (defense gaps).

Step 2: Fix pull_request_target + Fork Checkout (CRITICAL)

This is the #1 attack vector. 4 of 7 hackerbot-claw attacks exploited it. Check every pull_request_target workflow:

# DANGEROUS — runs fork code with your secrets
on: pull_request_target
steps:
  - uses: actions/checkout@v4
    with:
      ref: ${{ github.event.pull_request.head.sha }}  # ATTACKER'S CODE

# SAFE — use pull_request trigger instead (no secret access)
on: pull_request

# SAFE — if pull_request_target needed, checkout base only
on: pull_request_target
steps:
  - uses: actions/checkout@v4  # defaults to base branch

If the workflow needs both secrets AND fork code (e.g., comment on PR), split into two workflows: one that runs untrusted code (no secrets) and one that consumes artifacts (with secrets).

Step 3: Eliminate Expression Injection in run: Blocks

Any ${{ }} expression referencing user-controlled values inside a run: block is a shell injection. Branch names, filenames, PR titles, commit messages are all vectors.

# VULNERABLE — branch name is shell-evaluated
- run: echo "${{ github.event.pull_request.head.ref }}"

# SAFE — environment variable (properly quoted by runner)
- run: echo "$PR_HEAD_REF"
  env:
    PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}