Skip to content

v7.6.0 — Detection & response, threat-model bootstrap, GitHub Actions trigger trust, operating safety

Latest
Latest

Choose a tag to compare

View all tags
@kauenet kauenet released this 22 Oct 16:50
· 203 commits to main since this release
v7.6.0
5c203c8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Until now every flow assumed the code had not shipped yet. 7.6.0 adds:

  • a post-incident track;
  • threat models seeded from the target's own history;
  • coverage of who can start a privileged CI job;
  • written rules for running code and reading git metadata the auditor does not trust;
  • a Trail of Bits pin moved after a full review.

It ships as #21, which closes #13–#17 and #35.

Highlights

Detection & response (#14)

  • /auditor:hunt (no alert in hand) and /auditor:respond <lead> hand all reading and analysis of the incident corpus to a new incident-responder agent, which has no MCP tools and only proposes containment. Not signing is a rule the agent follows; isolated mode with no keypair mounted is what confines it.
  • references/detection-response/: one verdict ladder, log sources, a containment playbook and the INCIDENTS.json schema.
  • scripts/dnr/:
    • a read-only, capped RPC collector that runs only once the human approves the addresses, window and caps (or with --collect in non-interactive runs);
    • program snapshots that are never overwritten;
    • profile, log-frame and exact-delta recipes, where values above 2^53 stay exact.
  • Reproduction on the incident's own program bytes: templates/poc/run.sh with VULNERABLE_SO reports [PoC-REPRODUCED] only after the contract assertion ran and held on those bytes.

Threat-model bootstrap (#15)

  • /auditor:threat-model --bootstrap drafts the model from history before the interview, using:

    • keyword commits and reverts;
    • removed and added account guards;
    • churn;
    • prior audit reports and post-mortems;
    • INCIDENTS.json.

    Every attacker goal carries its evidence.

  • A read-only collector, scripts/threat-model/collect.sh, that follows Rule 11c.

GitHub Actions trigger trust (#16)

  • references/vuln-classes/github-actions.md covers:
    • comment-triggered commands and per-event author gating;
    • expression and env-file injection;
    • pull_request_target / workflow_run pwn requests, with artifact and cache poisoning;
    • AI coding agents in CI.
  • KV-139 and KV-140 (severity 9), DEP-090..096 and AI-034..035. Recipes R1–R8 are tested against 45 fixture workflows.

Operating safety: OUTPUT-RULES Rule 11 (#17)

  • 11a Execution mode. Intake asks once (Q46). Isolated is recommended; native is allowed, and the report then says so.
  • 11b Outside-service disclosure. The report lists each tool, the service it contacted and what it sent.
  • 11c Untrusted git checkouts. Every git command in a checkout the auditor did not create runs with a fixed safe prefix.
  • 11d Output hygiene. audit_<n>/, incident_<n>/ and .audit-memory/ ignore themselves.
  • 11e Bundled paths. Bundled scripts, tools and templates run from the installation root, never from the working directory.
  • Checklist 11 §11.11 Dependency-update review (SC-059..062), and a dependency lane in /auditor:diff-audit and /auditor:re-audit.

PoC harness

  • templates/poc/run.sh builds from a scratch copy outside the audited tree with a pinned toolchain.
  • Exits 1 and 2 need a contract assertion that ran and did not hold; any other failure is inconclusive.

Trail of Bits pin (#13)

  • vendor/trailofbits moves from cfe5d7b to 82fe822 after a delta review with the new read-only scripts/tob-delta-review.sh.
  • CI checks the README pin against the gitlink, and Dependabot opens monthly bumps for review. They are never auto-merged.

CI

  • corpus-check runs all eight self-test suites.
  • actions/checkout is pinned to v7.0.1 by SHA, with persist-credentials: false.

Upgrade notes

  • PoC builds need the execution mode. Pass AUDITOR_EXEC_MODE=isolated|native to templates/poc/run.sh. Without it, the script exits 3 before building and the PoC is [PoC-ATTEMPTED]. The commands pass the mode recorded at intake.
  • Intake has a new question (Q46). --auto records native as an assumed default, and the report says so.
  • Install outside any repository you audit.
    • install.sh warns inside a git work tree.
    • A run without a path never replaces an existing copy.
    • A run with a path moves the earlier install aside.
  • Bundled scripts prompt. hunt, respond and threat-model pre-approve no bundled scripts, so running one asks first (#37).
  • Live incidents: disconnect or deny write-capable MCP servers first. The commands call none, but they run in your session, where those servers remain callable.
  • Who gets the new pin. Plugin users receive it with this release; install.sh users get it on their next install.

Corpus: 20 checklists / 1,446 items / 140 vectors / 13 methodologies / 17 commands / 9 agents.

Credits: all text is our own, with nothing copied. These sources informed it:

  • Anthropic's defending-code reference harness (Apache-2.0);
  • getsentry/skills gha-security-review (Apache-2.0);
  • cloudflare/security-audit-skill (MIT).

See ATTRIBUTION.md.

Trail of Bits skills pin: 82fe822 (82fe8226252622fa807643bdca1710901198553a, trailofbits/skills main of 2026-09-28).

Full diff: v7.5.0...v7.6.0

Assets 2
Loading