💡 GitInject-Class PR Content Sanitization Layer for Review Pipeline Defense

[github-actions[bot]]

Summary

Add a pre-LLM content sanitization layer to the PR review pipeline (review-one-pr.sh) that detects and neutralizes prompt injection patterns embedded in PR descriptions, commit messages, and code comments before they reach the review LLM. This directly responds to the GitInject paper (arXiv 2606.09935, June 2026), which demonstrated real-world prompt injection attacks targeting exactly this class of AI-powered CI/CD pipeline — and to the OWASP finding that prompt injection attacks surged 340% year-over-year in 2026.

Market Signal

The GitInject paper (June 2026) specifically names GitHub Actions-based PR review agents as a target, identifying four attack vectors:

1. Untrusted PR content — malicious prompts in PR descriptions, code comments, and test output
2. Repository metadata exploitation — injection via workflow files, issue descriptions, commit messages
3. Indirect injection via external data — weaponized data from repositories or public APIs
4. Multi-stage attack chains — chained injections across multiple workflow steps

The Gemini CLI CVSS-10 supply chain vulnerability (May 2026, Pillar Security) demonstrated how indirect injection through code dependencies compromises development workflows. OWASP ranks prompt injection as the #1 LLM vulnerability (2026 report), with 73% of production AI agent deployments vulnerable to some form.

Source: GitInject: Real-World Prompt Injection Attacks in AI-Powered CI/CD Pipelines, OWASP Agentic Top 10

User Signal

The project has layered defenses:

• agent-shield.yml — workflow-trigger-level defense (gates WHICH workflows run; marked no-modify in AGENTS.md)
• push-protection.sh — secret scanning (blocks secret leaks in pushes)
• safety-checks.sh — pre-action safety validation

But these operate at different layers than content sanitization. The review pipeline currently passes raw PR diffs, descriptions, and commit messages directly to the LLM via prompt templates (prompts/triage.md, prompts/deep-review.md). No layer between "fetch PR content" and "send to LLM" inspects or sanitizes the content for injection patterns.

Discussion #651 (AWI Event-Context Input Sanitization) covers GitHub Agentic Workflows events — a different attack surface. Discussion #636/#794 (OWASP Agentic Top 10 Posture Scoring) is the broad framework; this is a specific, concrete sub-capability within that posture.

Technical Opportunity

The review pipeline has a clear injection point: review-one-pr.sh calls engine.sh's run_triage/run_agentic/run_duck with prompt files. A sanitization pre-filter can be inserted between "fetch PR content" and "pass to LLM" — a new scripts/lib/content-sanitize.sh that applies a tiered defense:

1. High-confidence patterns (instruction override markers, system-prompt injection, tool-use hijacking) → stripped silently
2. Medium-confidence patterns (role-play triggers, unusual control characters) → tagged with [SANITIZED] markers so the LLM knows content was modified
3. Audit trail — original unsanitized content logged for post-hoc review, not passed to LLM

This is additive — it doesn't modify agent-shield.yml or the prompt templates themselves. The existing shadow-mode infrastructure (Discussion #566) provides the validation pattern: run sanitized and unsanitized in parallel to measure review quality delta before enforcement.

Assessment

Dimension	Score	Rationale
Feasibility	med	Requires a curated injection pattern library + careful tuning to avoid over-sanitization false negatives
Impact	high	Directly hardens the fleet's most security-sensitive surface against the #1 OWASP LLM vulnerability
Urgency	med	The GitInject paper is published and the attack taxonomy is public; exploit tooling will follow

Adversarial Review

Strongest objection: Over-sanitization could strip legitimate content from PR descriptions (e.g., a PR that discusses prompt engineering might contain patterns that look like injection). This creates false negatives in reviews — the LLM sees sanitized content that doesn't match the actual code changes, leading to confused or incomplete reviews.

Rebuttal: The tiered defense mitigates this: only high-confidence injection patterns (explicit instruction overrides) are stripped; medium-confidence patterns are tagged, not removed. A shadow-mode rollout period compares review quality with/without sanitization before enforcement. Additionally, the pattern library is a curated allow-list of known injection techniques from the GitInject taxonomy — not a generic regex blacklist. The library is versioned and testable (bats tests against known injection payloads + known clean inputs).

Suggested Next Step

Catalogue the GitInject paper's attack taxonomy into a pattern library (scripts/lib/injection-patterns.sh), implement a content-sanitize.sh pre-filter with tiered severity levels, and validate in shadow mode by comparing review quality on recent PRs with/without sanitization enabled. Gate: zero false-positive sanitization events on a corpus of the last 50 PRs before enabling enforcement.