DEFCON34 DEMOLABS: sisakulint: CI-Friendly static linter with autofix, SAST, semantic analysis for GitHub Actions

https://sisaku-security.github.io/lint/
https://github.com/sisaku-security/sisakulint

GitHub Actions workflows are vulnerable by default. Hardening such as commit-hash pinning, least-privilege permissions, and timeouts is optional, never enforced at pipeline level. Exploitable configs ship daily, increasingly written by Coding Agents. sisakulint is a fast heuristic static analyzer for GitHub Actions covering all OWASP Top 10 CI/CD risks, with 52 rules, a taint engine, and 38+ auto-fixes. It outpaces CodeQL on speed and quality, with 100% detection on 18 GHSL advisories and 81.6% on 38 GHSAs covering exploits in PX4-Autopilot, vets-api, weaviate, nrwl/nx.

Impostor Commit at CVSS 9.8 validates pinned SHAs against the claimed repository, not impostors via Git forks, a check unique to sisakulint. Code Injection at CVSS 9.8 tracks untrusted input through ${{ }} and step outputs. AI Action Rules detect Clinejection on claude-code-action, copilot-swe-agent, and openai-actions, covering tool grants, prompt injection, and wildcard triggers, as in Cline 2026/02 where issue title injection stole NPM_RELEASE_TOKEN. Known Vulnerable Actions catches tj-actions/changed-files.

In the Coding Agent era, linters matter more. Delegating 52 rules to an LLM degrades precision; deterministic engines run in ms with no variance. The session covers end-to-end detection, taint propagation, and automated remediation.

Transcript

1. DEF CON 34 DEMO LABS sisakulint_ CI-Friendly static linter with autofix, SAST, semantic analysis for GitHub Actions built for AI coding agent era. $ brew install sisakulint▊ https://sisaku-security.github.io/lint Sada Atsushi · Hikaru Egashira | Apache-2.0
2. WHY THIS MATTERS NOW GitHub can enforce guardrails. It cannot trace unsafe data flow across a workflow. GUARDRAILS · enforceable DATA FLOW · invisible to policy ✓ Commit-SHA pinning untrusted input ✓ Token default permissions ✓ Action allow-lists └─▶ shell · agent prompt └─▶ secrets · privileged job Humans authored workflows. Now AI agents write — and run — them.
3. THE CLINE SUPPLY-CHAIN COMPROMISE · 2026-02 One issue title reached every downstream consumer INPUT Malicious issue title INTERPRETER › AI coding agent CAPABILITY › Shell execution IMPACT › Poisoned package release
4. THE VULNERABLE WORKFLOW Three lines, one poisoned package .github/workflows/agent.yml on: issues: types: [opened] jobs: ① Untrusted input enters the prompt agent: runs-on: ubuntu-latest ② Any user can trigger the agent steps: ③ Shell access is granted - uses: anthropics/claude-code-action@v1 with: prompt: "${{ github.event.issue.title }}" allowed_non_write_users: "*" ① ② claude_args: /-allowedTools "Bash,Write,Edit" ③
5. KILL CHAIN From issue title to poisoned release 01 02 03 04 05 Malicious issue Agent treats data as instructions Token or capability abused Poisoned release Downstream consumers affected › › › ›
6. WHAT SISAKULINT DOES Find the flow. Explain the risk. Fix the workflow. A workflow-aware static analyzer for GitHub Actions, with taint tracking and deterministic auto-fix. 52 38 18/18 Security rules Auto-fix rules Workflow-level GHSL advisories detected in our benchmark
7. HOW IT WORKS The dangerous flow crosses step boundaries SOURCE Untrusted input → ${{ github.event.pull_request.title }} ↓ tainted STEP Lands in a step output ↓ tainted ENV Read into an environment variable ↓ tainted JOB Crosses into another job or reusable workflow ↓ tainted SINK Reaches shell · agent prompt · privileged job Unlike pattern-matching linters, sisakulint tracks taint across steps, jobs, and reusable workflows . Workflow-aware taint graph over AST-parsed shell.
8. LIVE DEMO Demo 1 — Trace a real vulnerability WHAT YOU WILL SEE Untrusted PR input traced across multiple steps to a shell execution sink. ~/repo $ sisakulint build.yml:42:18: [Critical] flows into shell context untrusted input [code-injection-critical] 42 👈| run: echo "${{ github.event.pull_request.title }}" [sisaku: → Real vulnerable workflow → Finding path, hop by hop → SARIF + terminal output 🤔] Detected 1 error in 1 file checked
9. LIVE DEMO · 38 AUTO-FIX RULES, NOT LLM GUESSES Demo 2 — A fix you can review and reproduce BEFORE · injectable AFTER · $ sisakulint -fix on - name: - name: Echo title run: echo "${{ github.event.issue.title }}" → -fix on Echo title env: TITLE: ${{ github.event.issue.title }} run: echo "$TITLE"
10. AI AGENT SECURITY Three checks close the Cline attack path ai-action-prompt-injection ai-action-excessive-tools ai-action-unrestricted-trigger Prompt Injection Excessive Tools Unrestricted Trigger Untrusted input interpolated into an agent prompt Bash · Write · Edit granted under untrusted triggers allowed_non_write_users: "*" lets anyone fire the agent Data boundary · least capability · default-deny access
11. AI AGENT SECURITY · 3 RULES Three checks close the Cline attack path https://snyk.io/blog/cline-supply-chain-attack-prompt-injection-github-actions/
12. DIVISION OF LABOR LLMs discover. Linters enforce. AGENTS ARE USEFUL FOR DETERMINISTIC ANALYSIS IS REQUIRED FOR Explaining findings Repeatable decisions · deployment gates Suggesting changes Millisecond-scale checks Assisting triage Verifiable fixes The layer that decides whether a workflow is safe to run should not itself be probabilistic.
13. THREE WAYS TO RUN IT Use sisakulint your way CLI GitHub Action GitHub App Local development and coding-agent workflows. Runs on every pull request and push. Install once across selected repositories — no workflow files to copy. $ brew install sisakulint uses: sisaku-security/ sisakulint-action # pin SHA https://github.com/apps/sisakulint
14. OPEN SOURCE · APACHE-2.0 Scan one workflow now. → Install the GitHub App → Run the GitHub Action → Use the CLI $ brew install sisakulint ↗ github.com/sisaku-security/sisakulint — Star the repo. sisaku-security.github.io/lint Sada Atsushi · Hikaru Egashira | DEF CON 34 · Demo Labs
15. APPENDIX A Additional incidents GHSA-mrrh-fwg8-r2c3 GHSL FEED · MONTHLY tj-actions/changed-files A long tail of incidents Tag-pinned repositories inherited a compromised release. known-vulnerable-actions catches the CVE · impostor-commit stops the class workflow_run misuse cache poisoning pull_request_target escalation artifact poisoning
16. APPENDIX B Benchmark methodology 18/18 81.6% benchmark set GHSL advisories whose root cause is in workflow YAML — the surface a workflow SAST analyzes. All 18 detected. THE 7 UNDETECTED ADVISORIES — outside workflow files Runtime behavior Action internals Non-workflow code 38-advisory evaluation set Across all 38 GitHub Security Advisories evaluated, including cases outside workflow files.
17. APPENDIX C Tooling landscape sisakulint Workflow-aware taint tracking · deterministic auto-fix · AI Action + supply-chain rules actionlint Syntax and best-practice linting — security as a side concern zizmor Single-step security pattern matching CodeQL General-purpose code analysis with Actions queries // survey 2026-07 · characterizations from each tool's public documentation // numeric feature counts removed pending a version-pinned comparison methodology
18. APPENDIX D Integrations & performance SARIF native Remote scan Fix preview $ sisakulint -format "{{sarif .}}" $ sisakulint -remote owner/repo $ sisakulint -fix dry-run Drops into reviewdog and GitHub Code Scanning — no format adapters. Audit any public GitHub repository without cloning it. Review every rewrite before applying with -fix on. Single-pass parser + cached taint graph — seconds on large monorepo workflows, designed for pre-commit and PR checks.
19. APPENDIX E Demo runbook & fallback DEMO 1 Expected: 1 critical code-injection-critical finding with full taint path · exit code 1 DEMO 2 Expected: env-boundary rewrite as on slide 9 · re-running -fix on changes nothing (idempotent) DEMO 3 Expected: all 3 AI Action rules fire · clean scan after fixes applied OPTIONAL Org-wide sweep with -remote — only if time remains // fallback: recorded terminal casts of all three demos on local disk — no network required