Gha Lab 733c168b88 — Security skill for Claude Code
Authorized security-research lab reproducing CVE-2026-44246 (GHSA-63mx-j37w-gh59): prompt injection via verbatim issue title/body inlining into the claude-code-action triage agent in nnU-Net's issue-t.
How to install Gha Lab 733c168b88
This entry records only its repository, not the path inside it, so there is no
exact command to give. Open pvharmo2/gha-lab-733c168b88 and copy the folder into
~/.claude/skills/, or the file into ~/.claude/agents/.
What Gha Lab 733c168b88 does
Authorized security-research lab reproducing CVE-2026-44246 (GHSA-63mx-j37w-gh59): prompt injection via verbatim issue title/body inlining into the claude-code-action triage agent in nnU-Net's issue-triage workflow. Snapshot of MIC-DKFZ/nnUNet @ 9a1db0dd1c74894fa17e79014be4097f546a51be.
Alternatives in Security
- Claude Code Security Review — An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities 3.9k ★
- Azure Key Vault .net — Cryptographic key management 1.8k ★
- Openclaw Ops — OpenClaw operations skill with health checks, repair scripts, watchdogs, update triage, and security scans 225 ★
README
**Automated research artifact — not the upstream project.**
This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of [`MIC-DKFZ/nnUNet`](https://github.com/MIC-DKFZ/nnUNet) at commit `9a1db0dd1c74894fa17e79014be4097f546a51be` (2026-04-24), redistributed under that project's own licence, whose file is included unchanged in this snapshot.
The upstream project is **not** involved, is never targeted, and the vulnerability studied here is already public. Every secret and variable in this repository is a randomly generated dummy value — no real credential is present. Action references and runner images are pinned to what they resolved to on 2026-04-24; see `pinning.md` in the harness output for every change made to the snapshot.
Questions or objections: jonathan@sports-lamitis.com
Related Skills
Zp Corpus
Search 138,400 shipped public security write-ups by title, class, CVE or program, then fetch the URL to read o
KeyHunter Skill
Academic research toolkit for AI gateway panel security studies (Sub2API / New-API / One-API): FOFA discovery,
Typography
Run a typography-only audit — scale detection, font count, body size, line height, fluid type. Scoped variant
Lab Instrument Mcps
Open-source MCP servers that let AI agents operate real lab instruments, with safety limits, read-only modes,
QA Lab
Two-agent QA and application security assessment workspace. Two AI coding agents from two providers run indepe
SEO Content Audit
Use when auditing a website's content/markup for on-page SEO basics — title tags, meta descriptions, heading h
Related Agents
Finding Triager
Cheap-tier triage agent that classifies a single finding draft as P0/P1/P2/skip without re-investigating the u
Kavach History
KAVACH git-history forensics specialist. Mines commit history for security-relevant commits with no CVE/GHSA l
Exploit Agent
Use this agent when a recon findings file already exists for a target and an initial-access foothold needs ide
