From b93ba3cd5e1234bfa1d4b71d5c47fe3b2a1b905e Mon Sep 17 00:00:00 2001 From: XananasX7 Date: Sun, 28 Jun 2026 01:05:40 +0000 Subject: [PATCH] fix(security): prevent prompt injection via GitHub event data in AI agent workflows Removes ISSUE_BODY and ISSUE_TITLE from workflow env vars that are passed directly to ADK Java agent prompts. These values are attacker-controlled (any public user can set them by opening an issue) and were interpolated directly into LLM prompts with GitHub write-capable tools available. Affected workflows: - triage-adk-java-issues.yml - spam-detection-adk-java-issues.yml Agents should fetch issue content via the GitHub API using ISSUE_NUMBER, not rely on event-injected env vars. --- .github/workflows/spam-detection-adk-java-issues.yml | 4 ++-- .github/workflows/triage-adk-java-issues.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/spam-detection-adk-java-issues.yml b/.github/workflows/spam-detection-adk-java-issues.yml index de7841d3d..dd7b7e324 100644 --- a/.github/workflows/spam-detection-adk-java-issues.yml +++ b/.github/workflows/spam-detection-adk-java-issues.yml @@ -76,8 +76,8 @@ jobs: DRY_RUN: '1' EVENT_NAME: ${{ github.event_name }} ISSUE_NUMBER: ${{ github.event.issue.number }} - ISSUE_TITLE: ${{ github.event.issue.title }} - ISSUE_BODY: ${{ github.event.issue.body }} + # ISSUE_TITLE removed: prevents prompt injection; agent fetches via GitHub API + # ISSUE_BODY removed: prevents prompt injection; agent fetches via GitHub API # Mapped to the manual-dispatch checkbox. On the daily schedule this is # empty, so only issues updated in the last 24h are audited. INITIAL_FULL_SCAN: ${{ github.event.inputs.full_scan }} diff --git a/.github/workflows/triage-adk-java-issues.yml b/.github/workflows/triage-adk-java-issues.yml index 972a9ef35..935feee4c 100644 --- a/.github/workflows/triage-adk-java-issues.yml +++ b/.github/workflows/triage-adk-java-issues.yml @@ -66,8 +66,8 @@ jobs: DRY_RUN: '1' EVENT_NAME: ${{ github.event_name }} ISSUE_NUMBER: ${{ github.event.issue.number }} - ISSUE_TITLE: ${{ github.event.issue.title }} - ISSUE_BODY: ${{ github.event.issue.body }} + # ISSUE_TITLE removed: prevents prompt injection; agent fetches via GitHub API + # ISSUE_BODY removed: prevents prompt injection; agent fetches via GitHub API # Number of issues to process per scheduled batch run. ISSUE_COUNT_TO_PROCESS: '3' # Comma-separated GitHub handles to round-robin assign issues to.