🚨 Runner-Guard Security Finding
Rule: RGS-018 — Suspicious Payload Execution Pattern
Severity: High
File: .github/workflows/smoke-claude.lock.yml
Line: 1307
Description
A workflow run: block contains code patterns associated with obfuscated payload execution or known indicators of compromise (IOCs) from active supply chain attack campaigns. This includes eval+decode chains (e.g. eval(base64.b64decode(...)), base64 --decode | bash), known malware marker variables, persistence file paths, and C2 communication patterns. A match against a known IOC indicates active compromise; a match against a dangerous execution pattern indicates susceptibility to this class of supply chain attack.
Impact
If reachable by attacker-controlled input, the flagged pattern could enable arbitrary payload execution on a runner with secrets access. In generated .lock.yml files this is typically a false positive matching legitimate compiler-emitted base64/decode logic, but line 1307 has no prior triage record and should be reviewed to confirm it is compiler boilerplate and not an injected payload.
Remediation
- Inspect
.github/workflows/smoke-claude.lock.yml at line 1307 and identify the matched command.
- Confirm the snippet originates from the gh-aw compiler templates.
- If legitimate, suppress at the source template or record a documented RGS-018 allowlist entry for this file.
- If unexpected, treat as a potential supply-chain compromise and rotate exposed credentials.
Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/29982756775
Generated by 📊 Static Analysis Report · age00 200.8 AIC · ⌖ 31 AIC · ⊞ 10K · ◷
🚨 Runner-Guard Security Finding
Rule: RGS-018 — Suspicious Payload Execution Pattern
Severity: High
File:
.github/workflows/smoke-claude.lock.ymlLine: 1307
Description
A workflow
run:block contains code patterns associated with obfuscated payload execution or known indicators of compromise (IOCs) from active supply chain attack campaigns. This includes eval+decode chains (e.g.eval(base64.b64decode(...)),base64 --decode | bash), known malware marker variables, persistence file paths, and C2 communication patterns. A match against a known IOC indicates active compromise; a match against a dangerous execution pattern indicates susceptibility to this class of supply chain attack.Impact
If reachable by attacker-controlled input, the flagged pattern could enable arbitrary payload execution on a runner with secrets access. In generated
.lock.ymlfiles this is typically a false positive matching legitimate compiler-emitted base64/decode logic, but line 1307 has no prior triage record and should be reviewed to confirm it is compiler boilerplate and not an injected payload.Remediation
.github/workflows/smoke-claude.lock.ymlat line 1307 and identify the matched command.Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/29982756775