published Aug 26, 2026, 6:00 AM · updated Aug 26, 2026, 6:00 AM
Daily VulnHunter Scan
VulnHunter scan of github/gh-aw complete — no exploitable vulnerabilities confirmed. Scanned 38 of the 40 pre-ranked candidate files (2 absent from the snapshot, see gaps below). Phase 2 (injection class) surfaced 11 candidates; all 11 were eliminated in Phase 2b adversarial verification with cited file:line evidence.
Representative eliminations:
- validate_secrets.cjs:156 (GraphQL interpolation of owner/repo) — values come from context.repo/GITHUB_REPOSITORY; GitHub's owner/repo charset [A-Za-z0-9._-] excludes quotes and backslashes, so the string literal cannot be escaped. Gate 2a fail.
- artifact_client.cjs:418 (Content-Disposition -> path.join) — parseFilenameFromContentDisposition returns path.basename(...) at line 175, stripping all traversal.
- remote_download_file.go:338/453/462 (ref/path into git archive|clone|checkout) — gitutil.ValidateGitRef and ValidateGitPath gate every path (lines 302-306, 419-426), plus the
--end-of-options separator; argv exec, no shell. - start_mcp_gateway.cjs:922 (execSync with interpolated port) — safePort is String(gatewayPort).replace(/[^0-9]/g,""), and main() rejects non-numeric MCP_GATEWAY_PORT at line 557.
- graders_operational_value_regrade.go:383-386 (writes and executes an archived bash evaluator) — execution is gated by manifest/result digest consistency (333-338), repo-slug equality with the local checkout (353), and a byte-for-byte comparison against
git show <trusted SHA>:<path>(356-368). A tampered artifact cannot reach exec. - push_repo_memory.cjs:215-216/285, apply_samples.cjs:438/454, send_otlp_span.cjs:816 — all consume compiler-emitted or maintainer-authored frontmatter config rather than untrusted event data, and the values sit in operand (not flag) slots. Gate 2a fail.
The Go CLI surface (pkg/cli/*) executes subprocesses exclusively via exec.Command/exec.CommandContext with separate argv elements — never sh -c, never a shell string — with allow-list validation on docker image refs (grype.go:359, runner_guard.go:119).
Coverage gaps (declared, not silently dropped): .github/drivers/pi_agent_core_driver_sample_node.cjs and .squad/templates/ralph-triage.js were in scope but absent from the source-only snapshot; both live under dot-prefixed directories apparently filtered during bundle construction. They were not analysed.
Three non-security code-quality nits recorded for maintainers (GraphQL variables in validate_secrets.cjs:156; url.PathEscape the owner/repo segments in remote_resolve_sha.go:172; pass the OTLP endpoint as --url <endpoint> in send_otlp_span.cjs:816 so a leading dash can never be read as a curl flag). Full verification table written to out/phase2b_verification.md. No issue created per the reporting rules, since zero findings survived falsification.
Generated from Daily VulnHunter Scan · 286.6 AIC · ⌖ 49 AIC · ◇ 31.9 AIC · ⊞ 5.7K · ◷