🚨 Runner-Guard Security Finding
Rule: RGS-012 — Secret Exfiltration via Outbound HTTP Request
Severity: High
File: .github/workflows/daily-model-inventory.lock.yml
Line: 497 (also recurs at lines 1099, 1269, 1336 — 4 occurrences in this file)
Description
A run: block contains an outbound HTTP request command (curl, wget, httpie, python requests, node fetch, etc.) targeting a non-GitHub domain (i.e., not github.com, api.github.com, or ghcr.io) in a job context that has access to secrets or publishing capabilities. This pattern is a strong indicator of credential exfiltration — the primary objective of most GitHub Actions supply-chain attacks.
Impact
Attackers who achieve code execution in a CI runner (via expression injection, fork checkout, compromised action, etc.) need a way to exfiltrate stolen secrets to infrastructure they control. The most common method is an HTTP POST request to an attacker-owned domain carrying environment variables, secret values, or tokens as the request body. The combination of external HTTP requests with secrets access in a workflow is a high-confidence indicator worth manual review.
Investigation note: the flagged step ("Predownload models.dev API index") issues curl -fsS (models.dev/redacted) -o "$OUT/api.json" — a plain GET against a public, read-only API index, not a POST carrying secret data. This looks like a likely false positive, but the job context should be reviewed to confirm it does not also carry secrets that could be exfiltrated via this or a nearby step.
Remediation
- Confirm the job/step does not have unnecessary secrets exposure (scope
secrets:/env: to only what's required).
- If the outbound call is confirmed benign (public, read-only, no secret data in the request), add a scoped runner-guard suppression with a justification comment, or restrict the job's
permissions:/secrets so the rule no longer triggers.
- If any secret-bearing environment variable could reach this
run: block, remove that exposure or route the request through an allow-listed domain in the workflow's network egress config.
Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/31460155227
Generated by 📊 Static Analysis Report · agent · 150.9 AIC · ⌖ 33.6 AIC · ⊞ 11K · ◷
🚨 Runner-Guard Security Finding
Rule: RGS-012 — Secret Exfiltration via Outbound HTTP Request
Severity: High
File:
.github/workflows/daily-model-inventory.lock.ymlLine: 497 (also recurs at lines 1099, 1269, 1336 — 4 occurrences in this file)
Description
A
run:block contains an outbound HTTP request command (curl, wget, httpie, python requests, node fetch, etc.) targeting a non-GitHub domain (i.e., not github.com, api.github.com, or ghcr.io) in a job context that has access to secrets or publishing capabilities. This pattern is a strong indicator of credential exfiltration — the primary objective of most GitHub Actions supply-chain attacks.Impact
Attackers who achieve code execution in a CI runner (via expression injection, fork checkout, compromised action, etc.) need a way to exfiltrate stolen secrets to infrastructure they control. The most common method is an HTTP POST request to an attacker-owned domain carrying environment variables, secret values, or tokens as the request body. The combination of external HTTP requests with secrets access in a workflow is a high-confidence indicator worth manual review.
Investigation note: the flagged step ("Predownload models.dev API index") issues
curl -fsS (models.dev/redacted) -o "$OUT/api.json"— a plain GET against a public, read-only API index, not a POST carrying secret data. This looks like a likely false positive, but the job context should be reviewed to confirm it does not also carry secrets that could be exfiltrated via this or a nearby step.Remediation
secrets:/env:to only what's required).permissions:/secrets so the rule no longer triggers.run:block, remove that exposure or route the request through an allow-listed domain in the workflow's network egress config.Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/31460155227