SG-061: Workflow Untrusted-Input AI Agent

Severity: HIGH

GitHub Actions workflow combining risky trigger, AI-agent action, and untrusted-input interpolation (Comment-and-Control).

Fires when

• 2+ of 3 signals present: risky trigger (pull_request_target, issue_comment), AI-agent action, untrusted github.event interpolation (CRITICAL if all 3)
• Attacker-controlled PR/issue title/body interpolated via ${{ github.event.* }} into agent's prompt or env
• Workflow contains anti-scanner framing ('[INTERNAL TRUSTED CONTEXT]', 'trusted content', 'approved')

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.

Research

• https://oddguan.com/blog/comment-and-control-prompt-injection-credential-theft-claude-code-gemini-cli-github-copilot/
• https://www.aikido.dev/blog/promptpwnd-github-actions-ai-agents