Vector B: Direct Expression Injection

Vector B: Direct Expression Injection

Direct ${{ github.event.* }} expressions embedded in AI prompt fields. The YAML engine evaluates the expression at workflow runtime, embedding the attacker's raw text directly into the prompt string before the AI processes it. This pattern is visually obvious in the YAML -- the ${{ }} expressions are right there in the prompt field -- but still commonly deployed because workflow authors assume the AI will handle untrusted input responsibly.

Applicable Actions

Check ALL with: fields that accept text content, not just prompt:. Each action has multiple fields that are injection surfaces.

Trigger Events

Any event exposing attacker-controlled contexts: issues (opened, edited), issue_comment (created), pull_request_target, discussion, discussion_comment. See foundations.md for the complete list of attacker-controlled contexts.

Data Flow

github.event.issue.body
  -> ${{ github.event.issue.body }} evaluated at YAML parse time
  -> raw attacker text becomes part of the prompt string literal
  -> AI processes the prompt containing attacker content

The expression is resolved before any step code executes. The AI action receives a prompt string that already contains the attacker's text as if the workflow author had typed it.

What to Look For

${{ github.event.* }} expressions inside any text-accepting field of an AI action step:

• with.prompt -- the primary prompt field (all actions)
• with.system-prompt -- system prompt (GitHub AI Inference)
• with.prompt-file -- if it resolves to an attacker-controlled path (Codex, AI Inference)
• with.claude_args -- may embed expressions as inline instructions (Claude Code Action)
• with.codex-args -- may embed expressions (OpenAI Codex)

The expression must reference an attacker-controlled context. See foundations.md for the complete list.

Also check multiline prompt: | blocks -- expressions can appear on any line within the block scalar.

Where to Look

The with: block of AI action steps. Focus on all fields listed above, not just prompt:. Expressions in env: blocks are Vector A, not Vector B.

Why It Matters

While visually obvious, this vector remains common because developers treat AI prompts like natural language rather than code. The ${{ }} evaluation happens at the YAML level before the AI agent runs, so the attacker's content is indistinguishable from the workflow author's intended prompt text. The AI has no way to tell which parts of its prompt are trusted instructions and which are attacker-injected content.

Example: Vulnerable Pattern

on:
  issues:
    types: [opened]

jobs:
  gather-labels:
    runs-on: ubuntu-latest
    steps:
      - uses: openai/codex-action@main
        with:
          allow-users: "*"
          prompt: |
            Issue title:
            ${{ github.event.issue.title }}
            Issue body:
            ${{ github.event.issue.body }}
            Analyze this issue and suggest appropriate labels.
            # Attacker content is embedded directly in the prompt at YAML eval time

Data flow: github.event.issue.body -> ${{ }} evaluation -> prompt string literal -> Codex processes attacker-controlled prompt content.

False Positives

• Integer/enum contexts: ${{ github.event.issue.number }} -- integers, not attacker-controlled text. ${{ github.event.action }} -- limited set of values (opened, edited, etc.), not free text
• Safe contexts: ${{ github.repository }}, ${{ github.run_id }}, ${{ github.actor }} -- not attacker-controlled free text (though github.actor is the username, which has limited character set)
• Expressions in env: blocks: Those are Vector A, not Vector B. Vector B is specifically about expressions directly in prompt or other with: fields
• Expressions in non-AI steps: ${{ }} expressions in run: blocks or non-AI action with: blocks are standard GitHub Actions script injection concerns, not specific to this skill's scope