[Security Research] GitHub Bug Bounty PoC: Markdown injection via plugin.name in PR comments

[marwankhodair]

Security Research - GitHub Bug Bounty Program

This PR is a proof-of-concept submission for the GitHub Bug Bounty Program demonstrating that plugin.name in plugins/external.json is injected unescaped into automated PR comments by the external-plugin-pr-quality-gates.yml workflow.

Vulnerability: The pull_request_target workflow reads plugin.name from attacker-controlled fork PR data and inserts it directly into PR comment bodies via sync-pr-state job without HTML/Markdown escaping.

Expected result: The automated quality gate comment on this PR will render the plugin.name value as Markdown, showing a clickable hyperlink and bold text injected by the attacker-controlled plugins/external.json entry.

Impact: Markdown injection in GitHub-owned repo PR comments with pull-requests: write + issues: write permissions.

PoC plugin source: https://github.com/marwankhodair/bbp-test-01

Please do not merge this PR - it is a security research test only.

[github-actions]

🔒 PR Risk Scan Results

Scanned 1 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	0
ℹ️ Info	0

✅ No matching risk patterns were detected in changed files.

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

⚠️ External plugin PR checks need maintainer follow-up

• Changed entries detected: 1
• Workflow state label: awaiting-review

Per-plugin quality summary

Plugin	vally lint	install smoke test	version match	canvas structure	overall	source tree
BBP-PoC: Markdown Injection via plugin.name in github/awesome-copilot SECURITY RESEARCH	fail	fail	infra_error	not_run	infra_error	6dba280304fcba849cf9bf4e285af6a13489686e

Gate output details

[BBP-PoC: Markdown Injection via plugin.name in github/awesome-copilot](https://github.com/marwankhodair/bbp-test-01) **SECURITY RESEARCH** - vally lint (fail)

❌ [BBP-TEST Skill Name Injection](https://github.com/marwankhodair/bbp-test-01) **proof of markdown injection** (2/3 checks passed, 1 failed)
    ✗ [spec-compliance] 1 of 1 skill(s) have spec violations.
        ✗ spec-compliance: Spec checks failed.
            ✗ Name length (109) exceeds limit (64).
            ✗ Name "[BBP-TEST Skill Name Injection](https://github.com/marwankhodair/bbp-test-01) **proof of markdown injection**" contains invalid characters. Only lowercase letters, digits, and hyphens are allowed.
            ✗ Name "[BBP-TEST Skill Name Injection](https://github.com/marwankhodair/bbp-test-01) **proof of markdown injection**" does not match directory name "bbp-test".
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.
    ✓ [orphan-files] No orphan files found across 1 skill(s).
        ✓ orphan-files: No references/ directory found — no orphans possible.

1 skill(s) linted, 1 failed

[BBP-PoC: Markdown Injection via plugin.name in github/awesome-copilot](https://github.com/marwankhodair/bbp-test-01) **SECURITY RESEARCH** - install smoke test (fail)

Failed to add marketplace: Error: Invalid marketplace.json: plugins.0.name: Plugin name must be kebab-case (letters, numbers, and hyphens), plugins.0.name: String must contain at most 64 character(s)

[BBP-PoC: Markdown Injection via plugin.name in github/awesome-copilot](https://github.com/marwankhodair/bbp-test-01) **SECURITY RESEARCH** - version match (infra_error)

- main: Unable to read ".github/plugin/plugin.json" at "main": fatal: invalid object name 'main'.
- 6dba280304fcba849cf9bf4e285af6a13489686e: matched version "1.0.0" at "plugin.json".

[BBP-PoC: Markdown Injection via plugin.name in github/awesome-copilot](https://github.com/marwankhodair/bbp-test-01) **SECURITY RESEARCH** - canvas structure (not_run)

Canvas structure gate skipped because plugin is not tagged with "canvas".

• BBP-PoC: Markdown Injection via plugin.name in github/awesome-copilot SECURITY RESEARCH: vally-lint=fail, install-smoke=fail, version-match=infra_error, canvas-structure=not_run, overall=infra_error