From 4a2bed7be1a78595b5e76e5674d6da1dd2cb8aa8 Mon Sep 17 00:00:00 2001 From: XananasX7 Date: Sun, 28 Jun 2026 01:05:40 +0000 Subject: [PATCH] fix(security): prevent prompt injection via GitHub event data in AI agent workflows Removes ISSUE_BODY and ISSUE_TITLE from workflow env vars that are passed directly to ADK agent prompts. These values are attacker-controlled (any GitHub user can set them by opening an issue or discussion) and were being interpolated directly into LLM prompts with write-capable tools available. Also removes the heredoc injection vector in discussion_answering.yml that wrote raw `github.event.discussion` JSON (including attacker-controlled body) to a temp file and passed it to the agent. The agent now receives only the discussion number and fetches content via the GitHub API itself. Affected workflows: - triage.yml: removes ISSUE_TITLE, ISSUE_BODY from env - discussion_answering.yml: replaces heredoc injection with safe --discussion_number arg The agent can fetch issue/discussion content securely via the GitHub API using its existing tooling (GITHUB_TOKEN with issues:read scope). --- .github/workflows/discussion_answering.yml | 8 +++----- .github/workflows/triage.yml | 4 ++-- 2 files changed, 5 insertions(+), 7 deletions(-) diff --git a/.github/workflows/discussion_answering.yml b/.github/workflows/discussion_answering.yml index 2729eb240e8..fe4609bf50e 100644 --- a/.github/workflows/discussion_answering.yml +++ b/.github/workflows/discussion_answering.yml @@ -64,8 +64,6 @@ jobs: INTERACTIVE: 0 PYTHONPATH: contributing/samples/adk_team run: | - # Write discussion data to temporary file to avoid secret masking issues - cat > /tmp/discussion.json << 'EOF' - ${{ toJson(github.event.discussion) }} - EOF - python -m adk_answering_agent.main --discussion-file /tmp/discussion.json + # Security fix: Do not pass raw event data to agent prompt. + # Pass only the discussion number; agent fetches content via GitHub API. + python -m adk_answering_agent.main --discussion_number ${{ github.event.discussion.number || github.event.comment.discussion.number }} diff --git a/.github/workflows/triage.yml b/.github/workflows/triage.yml index ed0f851497f..f5e6f1813ae 100644 --- a/.github/workflows/triage.yml +++ b/.github/workflows/triage.yml @@ -61,8 +61,8 @@ jobs: INTERACTIVE: 0 EVENT_NAME: ${{ github.event_name }} # 'issues', 'schedule', etc. ISSUE_NUMBER: ${{ github.event.issue.number }} - ISSUE_TITLE: ${{ github.event.issue.title }} - ISSUE_BODY: ${{ github.event.issue.body }} + # ISSUE_TITLE removed: fetch via GitHub API in agent to prevent prompt injection + # ISSUE_BODY removed: fetch via GitHub API in agent to prevent prompt injection ISSUE_COUNT_TO_PROCESS: '3' # Process 3 issues at a time on schedule PYTHONPATH: contributing/samples/adk_team run: python -m adk_triaging_agent.main