[compiler-threat-spec] spec: extend CTR rule catalog to CTR-006 through CTR-011

[github-actions]

Summary

This PR extends the compiler threat detection specification from 5 rules (CTR-001–005) to 11 rules (CTR-001–011), synchronizing the spec with six threat categories that already have compiler implementations but were not yet documented.

Threats Reviewed

Rule	Threat Class	Already Implemented?	Action
CTR-001	Privilege Escalation	✅ Yes	Already in spec
CTR-002	Unpinned Action Integrity	✅ Yes	Already in spec
CTR-003	Unsafe Tool Scope Expansion	✅ Yes	Already in spec
CTR-004	Sandbox Bypass Configuration	✅ Yes	Already in spec
CTR-005	Unsafe Output Route	✅ Yes	Already in spec
CTR-006	Template Injection	✅ Yes	Added to spec
CTR-007	Markdown Content Security	✅ Yes	Added to spec
CTR-008	Pull Request Target Safety	✅ Yes	Added to spec
CTR-009	Shell Expansion in Safe-Outputs	✅ Yes	Added to spec
CTR-010	Expression Safety Allowlist	✅ Yes	Added to spec
CTR-011	Network Firewall Configuration	✅ Yes	Added to spec

Rule Details

• CTR-006: template_injection_validation.go detects ${{ ... }} expressions used directly in run: shell steps (not via env:), preventing user-controlled data from flowing into shell execution context.
• CTR-007: markdown_security_scanner.go scans externally-sourced markdown for unicode abuse, hidden content, obfuscated links, HTML abuse, embedded scripts, and social engineering.
• CTR-008: pull_request_target_validation.go enforces checkout restrictions for pull_request_target triggers and warns/errors on pwn-request risk in strict mode.
• CTR-009: safe_outputs_steps_shell_expansion_validation.go catches dangerous bash expansions (${var@op}, ${!var}, $(...), backticks) in safe-outputs run scripts at compile time.
• CTR-010: expression_safety_validation.go enforces an allowlist of approved expressions and rejects multi-line or unauthorized expressions.
• CTR-011: network_firewall_validation.go validates firewall configuration dependencies and rejects invalid domain patterns.

Files Changed

• specs/compiler-threat-detection-spec.md — version bumped to 1.0.1, Section 4.1 and 6.1 extended

References: §25534953257

Generated by Daily Compiler Threat Spec Optimizer · ● 7M · ◷

• expires on May 15, 2026, 3:33 AM UTC