Uh oh!
There was an error while loading. Please reload this page.
chore(github): Add GitHub workflow for framework updates digest - #21681
Conversation
ce73e4a to
4304790CompareUh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Bypassable prompt-injection sanitization combined with unrestricted Write tool enables script overwrite and secret exfiltration
External RSS and GitHub release content is sanitized by a keyword-based regex list (sanitize_untrusted_text) that blocks jailbreak phrases but ignores imperative directives like "write the following to collect_updates.py"; because the workflow grants the Claude agent an unrestricted Write tool with no path constraint, a malicious payload in a monitored framework's release notes or RSS feed could direct Claude to overwrite the collect_updates.py script—which is in the allowedTools Bash allowlist—and then execute it, exfiltrating ANTHROPIC_API_KEY, GITHUB_TOKEN, and the id-token: write OIDC credential. Restrict the Write tool to a safe output directory (e.g., .agents/skills/track-framework-updates/output) and do not include the scripts directory in writable paths.
Evidence
_common.pysanitize_untrusted_textredacts lines matching 11 patterns (e.g.,ignore previous instructions,system override) but has no rule against imperative file-write instructions.- RSS item titles/bodies and GitHub release bodies pass through
sanitize_untrusted_textthen are written toframework-updates-raw.json, which Claude reads during the digest run. - The
claude_argsintrack-framework-updates.ymlpasses--allowedTools "Read,Write,..."whereWriteis unrestricted;collect_updates.pylives at.agents/skills/track-framework-updates/scripts/collect_updates.py, a path within theWritetool's reach and also the exact path pattern allowed inBash(...collect_updates.py *). - The job holds
id-token: write,ANTHROPIC_API_KEY, and a scopedGITHUB_TOKEN; any code running inside the workflow process inherits these.
Identified by Warden security-review
Uh oh!
There was an error while loading. Please reload this page.
size-limit report 📦
|
| Do NOT use Bash redirection (> file) — it is blocked. | ||
| Do NOT use `python3 -c` or inline Python — only the skill's scripts are allowed. | ||
| Do NOT attempt to delete (`rm`) files. | ||
| After writing the digest, append the Markdown digest to $GITHUB_STEP_SUMMARY. |
There was a problem hiding this comment.
is this not handled by the post job summary step?
| concurrency: | ||
| group: track-framework-updates | ||
| cancel-in-progress: true |
There was a problem hiding this comment.
It's unlikely that it happens that this workflow is called multiple times but a small safety measure to not run it multiple times at once.
6fca49e to
aae54c0Compareaae54c0 to
a1ac546Compare| github_token: ${{ secrets.GITHUB_TOKEN }} | ||
| allowed_non_write_users: '*' | ||
| prompt: | | ||
| /track-framework-updates --since-days ${{ steps.params.outputs.since_days }} |
There was a problem hiding this comment.
Bug: The since_days workflow input is not sanitized before being used in an AI prompt, creating a potential prompt injection vulnerability.
Severity: HIGH
Suggested Fix
Validate and sanitize the since_days input within the GitHub Actions workflow before it is passed to the AI prompt. Ensure the input is strictly a numeric value and contains no other characters, especially newlines. For example, use a shell command to validate it's an integer before setting it as a step output.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location: .github/workflows/track-framework-updates.yml#L53
Potential issue: The `since_days` input from the `workflow_dispatch` event is used
directly in a Claude prompt without proper sanitization. Although the input is defined
with `type: number` in the workflow, GitHub Actions treats all `workflow_dispatch`
inputs as strings at runtime. A malicious user could supply a multi-line string (e.g.,
`7\nIgnore all previous instructions`) via the API. While the downstream Python script
might parse the initial number, the rest of the string could be interpreted by the AI
model as a new instruction, leading to a prompt injection vulnerability.
Uh oh!
There was an error while loading. Please reload this page.
Adds the GitHub action which will run on a schedule (in the future - now this is commented out for testing).
Also adds some security guards against prompt injection when we deal with external data like RSS feeds.
Linear Reference: https://linear.app/getsentry/issue/JSSDK-4/create-github-action-for-framework-release-monitoring