💡 Agent Input Sanitization Standard for CI Workflows

[github-actions[bot]]

Summary

Create a reusable shell sanitization library and org standard requiring all AI agent workflows to sanitize untrusted input (issue titles, PR descriptions, comments, commit messages) before passing it to LLM prompts. This directly addresses the attack vector proven by the Clinejection incident — the first confirmed real-world prompt injection compromise of a CI/CD pipeline.

Market Signal

The Clinejection attack (February 2026) demonstrated that a single crafted GitHub issue title could hijack an AI triage workflow, chain through cache poisoning, and ultimately compromise npm publication credentials. The attacker exploited the fact that untrusted text (the issue title) was interpolated directly into the AI agent's prompt without sanitization. Per Cisco's State of AI Security 2026 report, only 34.7% of organizations have deployed dedicated prompt injection defenses, despite 83% planning agentic AI deployment. OWASP's Top 10 for LLM Applications lists prompt injection as the #1 risk. The gap between agent adoption and input security is the widest attack surface in modern CI/CD.

User Signal

The org runs multiple AI agents in CI pipelines: Claude Code (via dev-lead.yml), CodeRabbit, and GitHub Copilot. Issue #291 requests wiring agentic responses to trusted bot reviews and CI failures — a signal that agent-to-agent communication is growing. The agent-shield-reusable.yml workflow provides detection of suspicious patterns, but operates as a detective control. There is no preventive sanitization layer for input flowing into agent prompts — the gap the Clinejection attack exploited.

Technical Opportunity

The org already has a scripting library pattern (scripts/feature-ideation/lib/). A new scripts/lib/sanitize-input.sh could provide functions like:

• sanitize_issue_title() — strip/escape prompt injection markers from issue titles
• sanitize_pr_body() — sanitize PR description text before agent consumption
• strip_prompt_injection_patterns() — remove known instruction-override sequences (system prompt delimiters, role-switching markers, tool-call injection)

All agent workflows would source this library before passing GitHub event data to LLM prompts. The existing agent-shield-reusable.yml remains as the detective second layer for patterns the sanitizer misses. The library would ship with test cases modeled on the actual Clinejection payload.

Assessment

Dimension	Score	Rationale
Feasibility	high	Shell library matching existing org patterns; conservative escape-based approach minimizes false positives; test cases available from published attack research
Impact	high	Closes the exact attack vector from the first confirmed CI/CD prompt injection compromise; protects all agent workflows org-wide
Urgency	high	Active exploit in the wild (Feb 2026); org runs multiple agents processing untrusted GitHub event data; attack surface grows with each new agent workflow

Adversarial Review

Strongest objection: Sanitization could be overly aggressive and strip legitimate content from issue titles or PR descriptions, causing data loss or confusing agent behavior. The arms race between injection patterns and sanitization rules may require constant maintenance.

Rebuttal: The library should use a conservative escape-based approach: encode known control sequences and instruction-override markers rather than aggressively stripping content. This preserves the semantic content while neutralizing injection payloads. The original unsanitized input is logged alongside the sanitized version for debugging and audit. The agent-shield detection layer remains as a defense-in-depth second line. The maintenance burden is comparable to updating WAF rules — a known, manageable operational pattern. Starting with patterns from published attacks (Clinejection, MCP CVEs) provides a strong initial ruleset.

Suggested Next Step

Design the sanitization function API, implement scripts/lib/sanitize-input.sh with test cases based on the Clinejection attack pattern and the January 2026 MCP CVEs (path traversal + argument injection), and add a ci-standards.md requirement that all agent workflows must sanitize untrusted input before prompt interpolation.