🚨 Runner-Guard Security Finding
Rule: RGS-018 — Suspicious Payload Execution Pattern
Severity: High
File: .github/workflows/copilot-setup-steps.yml
Line: 16
Description
Runner-Guard's taint analysis scanner detected a run: block matching code patterns associated with obfuscated payload execution or known indicators of compromise (IOCs) from active supply chain attack campaigns. This includes eval+decode chains (e.g., eval(base64.b64decode(...)), base64 --decode | bash), known malware marker variables, persistence file paths, and C2 communication patterns.
The specific pattern flagged here is a network-piped shell execution:
- name: Install gh-aw extension
run: curl -fsSL https://github.com/github/gh-aw/refs/heads/main/install-gh-aw.sh | bash
This curl ... | bash pattern executes arbitrary remote code in the runner. It also matches poutine's unverified_script_exec rule (separate finding).
Impact
- If the remote URL is ever compromised (rogue PR merged to
main, GitHub content-delivery hijack, DNS spoofing), the script content is executed in the runner with whatever permissions the calling job holds.
- The job grants
contents: read only, but the runtime context still has access to GITHUB_TOKEN and any environment-injected secrets.
- This pattern bypasses GitHub Actions' SHA-pinning model: there is no way to integrity-check the downloaded script content.
Remediation
- Replace the install-script pipe with a SHA-pinned action call or vendor the install script into this repository and run it from a known path.
- If a remote install must remain, pin to a specific commit SHA URL (e.g.,
raw.githubusercontent.com/github/gh-aw/<commit-sha>/install-gh-aw.sh) and verify its checksum before piping to bash.
- As a minimum, document the trust boundary in a comment near the step and ensure no secret-bearing job depends on outputs from this setup workflow.
Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/26144455365
Generated by 📊 Static Analysis Report · ● 24.4M · ◷
🚨 Runner-Guard Security Finding
Rule: RGS-018 — Suspicious Payload Execution Pattern
Severity: High
File:
.github/workflows/copilot-setup-steps.ymlLine: 16
Description
Runner-Guard's taint analysis scanner detected a
run:block matching code patterns associated with obfuscated payload execution or known indicators of compromise (IOCs) from active supply chain attack campaigns. This includes eval+decode chains (e.g.,eval(base64.b64decode(...)),base64 --decode | bash), known malware marker variables, persistence file paths, and C2 communication patterns.The specific pattern flagged here is a network-piped shell execution:
This
curl ... | bashpattern executes arbitrary remote code in the runner. It also matches poutine'sunverified_script_execrule (separate finding).Impact
main, GitHub content-delivery hijack, DNS spoofing), the script content is executed in the runner with whatever permissions the calling job holds.contents: readonly, but the runtime context still has access toGITHUB_TOKENand any environment-injected secrets.Remediation
raw.githubusercontent.com/github/gh-aw/<commit-sha>/install-gh-aw.sh) and verify its checksum before piping to bash.Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/26144455365