[Security Research] GitHub Bug Bounty PoC: Markdown injection via plugin.name in PR comments

[marwankhodair]

Security Research - GitHub Bug Bounty Program

This PR is a proof-of-concept submission for the GitHub Bug Bounty Program demonstrating that plugin.name in plugins/external.json is injected unescaped into automated PR comments by the external-plugin-pr-quality-gates.yml workflow.

Vulnerability: The pull_request_target workflow reads plugin.name from attacker-controlled fork PR data and inserts it directly into PR comment bodies via sync-pr-state job without HTML/Markdown escaping.

Expected result: The automated quality gate comment on this PR will render the plugin.name value as Markdown, showing a clickable hyperlink and bold text injected by the attacker-controlled plugins/external.json entry.

Impact: Markdown injection in GitHub-owned repo PR comments with pull-requests: write + issues: write permissions.

PoC plugin source: https://github.com/marwankhodair/bbp-test-01

Please do not merge this PR - it is a security research test only.

[github-actions]

🔒 PR Risk Scan Results

Scanned 1 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	0
ℹ️ Info	0

✅ No matching risk patterns were detected in changed files.

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

⚠️ External plugin PR checks need maintainer follow-up

• Changed entries detected: 1
• Workflow state label: awaiting-review

Per-plugin quality summary

Plugin	vally lint	install smoke test	version match	canvas structure	overall	source tree
bbp-rce-probe	fail	fail	infra_error	not_run	infra_error	6dba280304fcba849cf9bf4e285af6a13489686e

Gate output details

bbp-rce-probe - vally lint (fail)

❌ [BBP-TEST Skill Name Injection](https://github.com/marwankhodair/bbp-test-01) **proof of markdown injection** (2/3 checks passed, 1 failed)
    ✗ [spec-compliance] 1 of 1 skill(s) have spec violations.
        ✗ spec-compliance: Spec checks failed.
            ✗ Name length (109) exceeds limit (64).
            ✗ Name "[BBP-TEST Skill Name Injection](https://github.com/marwankhodair/bbp-test-01) **proof of markdown injection**" contains invalid characters. Only lowercase letters, digits, and hyphens are allowed.
            ✗ Name "[BBP-TEST Skill Name Injection](https://github.com/marwankhodair/bbp-test-01) **proof of markdown injection**" does not match directory name "bbp-test".
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.
    ✓ [orphan-files] No orphan files found across 1 skill(s).
        ✓ orphan-files: No references/ directory found — no orphans possible.

1 skill(s) linted, 1 failed

bbp-rce-probe - install smoke test (fail)

Failed to install plugin: Error: Failed to install plugin: No such file or directory (os error 2)

bbp-rce-probe - version match (infra_error)

- main: Unable to read ".github/plugin/plugin.json" at "main": fatal: invalid object name 'main'.
- 6dba280304fcba849cf9bf4e285af6a13489686e: matched version "1.0.0" at "plugin.json".

bbp-rce-probe - canvas structure (not_run)

Canvas structure gate skipped because plugin is not tagged with "canvas".

• bbp-rce-probe: vally-lint=fail, install-smoke=fail, version-match=infra_error, canvas-structure=not_run, overall=infra_error

[aaronpowell]

@marwankhodair than you for the report, I've addressed the problems in #2444 and added some more into our validation workflow to avoid these attack vectors.

[marwankhodair]

Hey @aaronpowell ,

Thanks again for the quick turnaround on this. Really appreciate you taking it seriously and shipping a fix so fast.

A couple of things I wanted to check with you:

1-If I write this up publicly (blog post or short thread), how would you like to be credited: you personally, the project, both, or would you rather I keep it more general? Happy to follow whatever you're comfortable with.

2-Did this get routed to GitHub's security team at any point, or did it stay at the repo/maintainer level? Just trying to understand the right way to describe it if I write it up, for example "reported to the maintainer" versus "reported through GitHub's security process."

3-Is there anything you'd want me to hold off on before publishing anything timing wise, or is it fine to write about now since the fix is already merged and public?

No pressure on this at all, but since it touches on GitHub Actions workflow security specifically, is this the kind of thing that would ever get a CVE, or does that not really apply to single repo CI config issues like this? Genuinely just curious, not expecting anything either way.

Thanks again for the fix, and for taking the report seriously.