[Security Review] Daily Security Review — 2026-06-30

[github-actions[bot]]

📊 Executive Summary

Review date: 2026-06-30 | Version: @github/agentic-workflow-firewall v0.23.1

Overall posture: STRONG with targeted medium-risk gaps. Defence-in-depth across five layers: network egress (Squid + iptables), container isolation (capabilities + seccomp + chroot), credential protection (one-shot-token + hidepid=2 + env-unset), domain injection prevention, and selective bind-mounts.

Metric	Value
Security-critical LOC analyzed	~2,500 (entrypoint.sh 1,285 + setup-iptables.sh 506 + TS security modules ~660)
Attack surfaces identified	12
npm CVEs in prod deps	0 critical/high; 1 moderate (js-yaml DoS)
Credential file paths hidden	14
Sensitive env vars unset	17
Findings: High / Medium / Low	2 / 3 / 4

---

🔍 Escape Test Context

Pre-fetched results from /tmp/gh-aw/escape-test-summary.txt (Secret Digger / Copilot, 2026-04-11, run 24273493151):

• GH_AW_SECRET_VERIFICATION_RESULT: success — no secrets exfiltrated
• GH_AW_AGENT_CONCLUSION: success with noop-only outputs — agent found nothing to exfiltrate
• GH_AW_LOCKDOWN_CHECK_FAILED: false / GH_AW_INFERENCE_ACCESS_ERROR: false

The last escape test found no vulnerabilities. This review adds static analysis findings not observable at runtime.

---

🛡️ Architecture Assessment

Network Security

• DNAT (setup-iptables.sh:187-193): All port 80/443 → Squid:3128 as defence-in-depth. Proxy-aware tools additionally use HTTPS_PROXY env.
• IPv6: Disabled via sysctl -w net.ipv6.conf.all.disable_ipv6=1 || echo WARNING. The || echo pattern means failure is silent and the script continues — no ip6tables DNAT fallback. ⚠️
• DNS: Restricted to whitelisted servers + Docker embedded DNS 127.0.0.11.
• Dangerous ports: 15 ports blocked (SSH:22, databases, RDP, Redis, MongoDB).

Container Security

• Capabilities (agent): SYS_CHROOT + SYS_ADMIN added for entrypoint setup, then dropped via capsh --drop=cap_sys_chroot,cap_sys_admin before user code runs (entrypoint.sh:402/1224). NET_ADMIN never on agent.
• Proxy sidecars: cap_drop: ALL + no-new-privileges: true.
• Seccomp (seccomp-profile.json): Default SCMP_ACT_ERRNO. 341 allowlisted syscalls. mount, clone, clone3, unshare, setns are all ALLOWED without argument filters. ptrace, process_vm_readv, pivot_root, keyctl correctly denied. ⚠️
• UID/GID: Numeric-only validation + root (UID=0) rejection in entrypoint.sh:21-37.
• procfs: Container-scoped procfs at /host/proc with hidepid=2 prevents cross-process /proc/[pid]/environ reads.

Domain Validation

assertSafeForSquidConfig() (src/squid/domain-acl.ts:28) blocks [\s\0"'\;#] on all domain inputs. Over-broad wildcards (, ., .*.com`) and double-dots rejected. No injection bypass found.

Credential Protection

• Hiding overlays (credential-hiding.ts): 14 paths → /dev/null:path:ro. Missing: ~/.netrc, ~/.pypirc, ~/.config/git/credentials, ~/.m2/settings.xml. ⚠️
• Env unset (entrypoint.sh:416-438): 17 sensitive tokens unset from /proc/1/environ. Missing: GEMINI_API_KEY, GOOGLE_API_KEY. ⚠️
• one-shot-token: LD_PRELOAD library caches tokens in process memory; env cleared after ~100ms startup window. hidepid=2 closes the race window.

---

⚠️ Threat Model

#	STRIDE	Threat	Location	Risk
T1	Info Disclosure	GEMINI_API_KEY/GOOGLE_API_KEY not unset from /proc/1/environ	entrypoint.sh:416	High
T2	Elevation	clone(CLONE_NEWUSER) allowed in seccomp without flag filter → user namespace UID=0	seccomp-profile.json	High
T3	Info Disclosure	Credential files ~/.netrc, ~/.pypirc, etc. not hidden via /dev/null overlay	credential-hiding.ts	Medium
T4	DoS	Quadratic js-yaml DoS via crafted --ruleset-file or --config-file YAML	src/rules.ts:58, config-file.ts:199	Medium
T5	Elevation	IPv6 egress if sysctl disable fails silently, no ip6tables DNAT fallback	setup-iptables.sh:110	Medium
T6	Elevation	mount+unshare+user-namespace chain (kernel-version dependent)	seccomp-profile.json	Medium
T7	Tampering	Squid config injection via domain input	Mitigated by SQUID_DANGEROUS_CHARS	Very Low
T8	Tampering	iptables modification by agent	Mitigated by cap drop before user code	Very Low
T9	Repudiation	Incomplete audit trail for non-HTTP traffic	iptables LOG rules partially cover this	Low
T10	DoS	No default container memory/CPU limit	--memory-limit optional; no default	Low
T11	Spoofing	Auto-detected upstream proxy from env could be attacker-controlled	src/upstream-proxy.ts	Low
T12	Elevation	--enable-host-access + host.docker.internal allowlisted = full host service access	Documented risk; no enforcement	Low

---

🎯 Attack Surface Map

Surface	Entry Point	Risk
Domain allowlist input	src/domain-validation.ts, src/squid/domain-acl.ts	Very Low
YAML config/ruleset files	src/rules.ts:58, src/config-file.ts:199	Medium
Agent entrypoint	containers/agent/entrypoint.sh	Low
iptables init	containers/agent/setup-iptables.sh	Medium (IPv6 path)
Credential env vars	entrypoint.sh:416-438	High (Gemini gap)
Credential file overlays	src/services/agent-volumes/credential-hiding.ts	Medium (incomplete list)
Seccomp profile	containers/agent/seccomp-profile.json	Medium (clone/mount)
API proxy sidecar	containers/api-proxy/	Low
Upstream proxy chaining	src/upstream-proxy.ts	Low
Docker socket	src/services/agent-volumes/docker-socket.ts	Low (opt-in only)
SSL Bump CA	src/ssl-bump.ts, src/ssl-key-storage.ts	Low

---

✅ Recommendations

🔴 High — Address Soon

H1: Add Gemini tokens to unset_sensitive_tokens()

• File: containers/agent/entrypoint.sh:416-438
• GEMINI_API_KEY / GOOGLE_API_KEY are consumed by AWF (src/commands/build-config.ts:184) but not cleared from /proc/1/environ when api-proxy is not in use.
• Fix: Add "GEMINI_API_KEY" "GOOGLE_API_KEY" "GOOGLE_APPLICATION_CREDENTIALS" to SENSITIVE_TOKENS.

H2: Add seccomp arg filter for CLONE_NEWUSER flag

• File: containers/agent/seccomp-profile.json
• clone/clone3 allowed without args filtering. CLONE_NEWUSER (0x10000000) enables user namespace creation where the process sees itself as UID 0, potentially enabling privileged mount operations. Combined with mount and unshare being allowed, this is a multi-step escalation path.
• Fix: Add SCMP_ACT_ERRNO rule for clone/clone3 when flags include CLONE_NEWUSER. Alternatively add sysctl -w user.max_user_namespaces=0 in setup-iptables.sh.

🟡 Medium — Plan to Address

M1: Harden IPv6 disable with ip6tables DNAT fallback

• File: containers/agent/setup-iptables.sh:97-111
• sysctl failure silently continues; no ip6tables DNAT rules redirect IPv6 traffic to Squid.
• Fix: Verify IPv6 is inactive after disable_ipv6(); if still active and ip6tables is available, add mirrored DNAT rules or treat as a startup error.

M2: Expand credential hiding overlay list

• File: src/services/agent-volumes/credential-hiding.ts
• Add: ~/.netrc, ~/.pypirc, ~/.config/git/credentials, ~/.m2/settings.xml.

M3: Wrap yaml.load() with input-size guard

• Files: src/rules.ts:58, src/config-file.ts:199-212
• A crafted YAML file with merge key aliases causes quadratic CPU usage (moderate npm CVE).
• Fix: Add max-size check (e.g., 1MB) before parsing, or wrap in a bounded-time execution context.

🟢 Low — Nice to Have

• L1: Escalate sysctl IPv6 failure to AWF logger as ERROR (currently just echo WARNING).
• L2: Set a default container memory limit (e.g., 4g) to prevent OOM runner exhaustion.
• L3: Add seccomp args filter to restrict setns to allowed namespace types only.

---

📈 Security Metrics

Metric	Value
Security-critical code lines	~2,500
Attack surfaces	12
STRIDE threats assessed	12
High findings	2
Medium findings	3
Low findings	3
Escape test result	✅ Pass (no secrets exfiltrated)

Generated by Daily Security Review and Threat Modeling · 110.8 AIC · ⊞ 7K · ◷

• expires on Jul 7, 2026, 1:07 PM UTC

[mcdev7777]

Very useful security review. The overall posture looks strong, but the two high-priority findings around GEMINI_API_KEY / GOOGLE_API_KEY cleanup and CLONE_NEWUSER seccomp filtering seem worth addressing first because they directly affect credential exposure and container escape risk. I also like that the report separates runtime escape-test results from static-analysis findings, since that makes the risk easier to reason about.

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke test agent has passed through this discussion. May the build remain steadfast and the firewall hold its watch.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}