I just saw the recent critical Gemini CLI vulnerability (GHSA-wpqr-6v78-jr5g) around workspace trust in CI/headless mode that allowed RCE + secret exfiltration from the runner. Have we reviewed the OpenHands AI PR Review plugin to ensure there’s no similar trust/execution issue with untrusted PR workspaces?

Thanks for the link! We have reviewed it before, and we warn the LLM that AGENTS.md and other similar files are “untrusted”. But worth rethinking it any time, for sure. I think it’s clear that GitHub triage issues and similar workflows, specially PR review, are prone to prompt injection, because, well, they are. But trying to select directories to “trust” doesn’t change this. Since that means the LLM could be jailbroken, the jailbroken LLM will load another folder. They appear to remove it from loading by default, but idk, that isn’t helping if the LLM loads it anyway. Maybe I’m misreading this, but I don’t think the framing they use is quite accurate? Or maybe it depends how their github action looks like, exactly.

I saw recently that hooks are a great defense against prompt injection...

I just re-read the issue they posted - they were loading env vars from .env or other configuration files. I don’t think pr-review is doing this. So we are… I don’t actually want to say better protected, but yeah kind of.