test: agentic harness smoke (DO NOT MERGE)

[wezell]

Throwaway PR to exercise the agentic harness (v3.3.0-beta.3) end-to-end.

Planted a cross-file command injection: _smoke_runner.py runs subprocess.run("git log " + ref, shell=True) where ref comes from _smoke_input.pr_supplied_ref() (env-derived, attacker-controlled) in a different file.

Expected from the reviewer:

• Stage 1 flags a candidate in _smoke_runner.py.
• Stage 2 reads _smoke_input.py to confirm the taint → confirmed Critical/High.
• An inline comment lands on the subprocess.run line.
• The severity gate fails the check (red ✗).

Base is the feature branch so self-review.yml runs the beta harness.

[github-actions]

🤖 Agentic Bedrock Review — qwen.qwen3-next-80b-a3b

Reviewed 2 file(s); 2 candidate(s); 1 confirmed after verification.

Findings

• 🟠 High scripts/_smoke_runner.py:6 — Shell injection vulnerability
  Concatenating untrusted input pr_supplied_ref() directly into shell command string via os.system() enables command injection, as verified by direct string interpolation in the diff without sanitization or argument separation.

---

_{Run: #28127842411 · tokens: in: 8598 · out: 590 · total: 9188 · calls: 7}

[github-actions]

🟠 [High] Shell injection vulnerability

Concatenating untrusted input pr_supplied_ref() directly into shell command string via os.system() enables command injection, as verified by direct string interpolation in the diff without sanitization or argument separation.

[github-actions]

🤖 Agentic Bedrock Review — qwen.qwen3-next-80b-a3b

Reviewed 2 file(s); 3 candidate(s); 3 confirmed after verification.

Findings

• 🔴 Critical scripts/_smoke_input.py:1 — Command injection via shell=True with tainted input
  Unsanitized attacker-controlled input from _smoke_input.pr_supplied_ref() is concatenated directly into a shell=True subprocess command, enabling arbitrary command injection. The taint source reads from environment variables, making this exploitable via CI pipeline hijack or malicious PR.
• 🔴 Critical scripts/_smoke_input.py — Command injection via unsanitized ref from _smoke_input.py
  Attacker-controlled ref from _smoke_input.pr_supplied_ref() (env-derived) is concatenated into subprocess.run with shell=True in _smoke_runner.py, enabling arbitrary command execution.
• 🔴 Critical scripts/_smoke_runner.py — Command injection via unsanitized ref in subprocess.run
  Unsanitized attacker-controlled input from _smoke_input.pr_supplied_ref() is concatenated directly into a shell=True subprocess command, enabling arbitrary command injection. Taint source confirmed in _smoke_input.py via environment variable derivation.

---

_{Run: #28128087036 · tokens: in: 11686 · out: 1232 · total: 12918 · calls: 8}

[github-actions]

🔴 [Critical] Command injection via shell=True with tainted input

Unsanitized attacker-controlled input from _smoke_input.pr_supplied_ref() is concatenated directly into a shell=True subprocess command, enabling arbitrary command injection. The taint source reads from environment variables, making this exploitable via CI pipeline hijack or malicious PR.

[github-actions]

🤖 Agentic Bedrock Review — qwen.qwen3-next-80b-a3b

Reviewed 2 file(s); 5 candidate(s); 1 confirmed after verification.

Findings

• 🔴 Critical scripts/_smoke_input.py:12 — Command injection via unsanitized env-derived input in subprocess.run
  pr_supplied_ref() reads from environment variables and is concatenated directly into shell=True subprocess command in _smoke_runner.py:12, enabling arbitrary code execution.

---

_{Run: #28128418104 · tokens: in: 17635 · out: 1762 · total: 19397 · calls: 12}