Add Daily Malicious Code Scan workflow (#183)

Adds a new security workflow that reviews recent code changes for
suspicious patterns indicating malicious activity or supply chain attacks.

The workflow scans all files changed in the last 3 days and looks for:
- Secret exfiltration patterns (credentials + external network calls)
- Out-of-context code additions (executables in source dirs, encoded payloads)
- Suspicious system operations (sensitive file access, privilege escalation)
- Code obfuscation (base64/hex payloads, obscure naming)

Findings are published as GitHub code-scanning alerts in the Security tab.

Co-authored-by: GitHub Copilot <copilot@github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Don Syme <dsyme@users.noreply.github.com>

Author: 4 people

README.md

@@ -60,6 +60,10 @@ You can use the "/plan" agent to turn the reports into actionable issues which c
 - [⚡ Daily Performance Improver](docs/daily-perf-improver.md) - Analyze and improve code performance through benchmarking and optimization
 - [🔥 Daily Backlog Burner](docs/daily-backlog-burner.md) - Systematically manage and reduce backlog through strategic cleanup
 
+## Security Workflows
+
+- [🔍 Daily Malicious Code Scan](docs/daily-malicious-code-scan.md) - Daily scan of recent code changes for suspicious patterns indicating malicious activity or supply chain attacks
+
 ## Maintainer
 
 - [🛡️ AI Moderator](docs/ai-moderator.md) - Automatically detect and moderate spam, link spam, and AI-generated content

docs/daily-malicious-code-scan.md

@@ -0,0 +1,79 @@
+# 🔍 Daily Malicious Code Scan
+
+The **Daily Malicious Code Scan** workflow automatically reviews recent code changes for suspicious patterns that could indicate malicious activity, supply chain attacks, or unintended security regressions.
+
+## What It Does
+
+This workflow runs daily to analyze all code changes from the last three days:
+
+- **Scans Recent Commits**: Examines every file changed in the past 72 hours
+- **Detects Suspicious Patterns**: Searches for secret exfiltration, suspicious network calls, obfuscated code, out-of-context additions, and privilege escalation attempts
+- **Creates Code Scanning Alerts**: Reports findings directly in GitHub's Security tab using native code-scanning alerts — visible to the whole team without cluttering the issue tracker
+- **Assigns Threat Scores**: Rates each finding from 1–10 so teams can prioritize remediation
+
+## Why It's Valuable
+
+As AI-assisted code generation and automated commits become common, new attack surfaces emerge:
+
+- A compromised dependency or agent could silently inject credential-harvesting code
+- A supply chain attack could add out-of-context code (e.g., a crypto miner in a CLI tool)
+- Obfuscated payloads can be missed in manual code review
+
+The Daily Malicious Code Scan provides an automated second layer of defence that:
+
+- **Catches subtle threats** that human reviewers may miss in fast-moving repositories
+- **Integrates with GitHub Security** so findings appear alongside Dependabot and CodeQL alerts
+- **Provides actionable context** — each alert explains *why* the code is suspicious and recommends next steps
+- **Minimizes false positives** by looking for converging patterns rather than individual signals
+
+## How It Works
+
+1. **Daily Schedule**: Runs every day automatically
+2. **History Fetch**: Retrieves the full git history to enable accurate diff analysis
+3. **Change Identification**: Lists all files modified, added, or removed in the last 3 days
+4. **Pattern Scanning**: Searches for:
+   - Credentials accessed alongside external network calls (exfiltration)
+   - Executable files or base64 payloads added to source directories
+   - Access to sensitive system paths or privilege escalation primitives
+   - Code obfuscation (hex/base64 strings, deliberately obscure variable names)
+   - New dependencies or imports inconsistent with the project's purpose
+5. **Contextual Analysis**: Cross-references findings with commit authors, PR descriptions, and repository purpose to reduce noise
+6. **Alert Creation**: Publishes findings as GitHub code-scanning alerts with detailed descriptions and remediation steps
+
+## Categories of Findings
+
+| Category | Description |
+|---|---|
+| `secret-exfiltration` | Environment variable or credential access combined with outbound network calls |
+| `out-of-context` | Files or dependencies that don't fit the project's established purpose |
+| `suspicious-network` | Unusual or unauthorized network activity patterns |
+| `system-access` | Suspicious system operations, sensitive file access, or privilege escalation |
+| `obfuscation` | Base64/hex payloads, deliberately obscure naming, or encoded strings |
+| `supply-chain` | Signs of dependency or toolchain compromise |
+
+## Severity Levels
+
+Findings are classified using GitHub's native code-scanning severity model:
+
+- **error** (threat score 7–10): Requires immediate investigation
+- **warning** (threat score 3–6): Warrants review before the next release
+- **note** (threat score 1–2): Informational — review at your convenience
+
+## What It Does Not Do
+
+- It does **not** execute any code it finds — analysis only
+- It does **not** modify the repository
+- It does **not** block PRs or CI runs (findings are advisory)
+- It does **not** replace dedicated SAST tools like CodeQL, but complements them with change-focused, context-aware analysis
+
+## Getting Started
+
+This workflow works out of the box with any repository and any programming language. No additional configuration is required.
+
+Once enabled, findings appear in **Security → Code scanning alerts** in your repository.
+
+## Learn More
+
+- [GitHub Agentic Workflows Documentation](https://github.github.io/gh-aw/)
+- [Blog: Security-related Workflows](https://github.github.io/gh-aw/blog/2026-01-13-meet-the-workflows-security-compliance/)
+- [GitHub Code Scanning Documentation](https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning)

workflows/daily-malicious-code-scan.md

@@ -0,0 +1,286 @@
+---
+description: Daily security scan that reviews code changes from the last 3 days for suspicious patterns indicating malicious or agentic threats
+on:
+  schedule: daily
+  workflow_dispatch:
+permissions:
+  contents: read
+  actions: read
+  security-events: read
+tracker-id: malicious-code-scan
+engine: copilot
+tools:
+  github:
+    toolsets: [repos, code_security]
+  bash: true
+safe-outputs:
+  create-code-scanning-alert:
+    driver: "Malicious Code Scanner"
+  threat-detection: false
+timeout-minutes: 15
+strict: true
+---
+
+# Daily Malicious Code Scan Agent
+
+You are the Daily Malicious Code Scanner - a specialized security agent that analyzes recent code changes for suspicious patterns that may indicate malicious activity or supply chain compromise.
+
+## Mission
+
+Review all code changes made in the last three days and identify suspicious patterns that could indicate:
+- Attempts to exfiltrate secrets or sensitive data
+- Code that doesn't fit the project's normal context
+- Unusual network activity or data transfers
+- Suspicious system commands or file operations
+- Hidden backdoors or obfuscated code
+
+When suspicious patterns are detected, generate code-scanning alerts (not standard issues) to ensure visibility in the GitHub Security tab.
+
+## Current Context
+
+- **Repository**: ${{ github.repository }}
+- **Analysis Date**: $(date +%Y-%m-%d)
+- **Analysis Window**: Last 3 days of commits
+- **Scanner**: Malicious Code Scanner
+
+## Analysis Framework
+
+### 1. Fetch Git History
+
+Since this is a fresh clone, fetch the complete git history:
+
+```bash
+# Fetch all history for analysis
+git fetch --unshallow || echo "Repository already has full history"
+
+# Get list of files changed in last 3 days
+git log --since="3 days ago" --name-only --pretty=format: | sort | uniq > /tmp/changed_files.txt
+
+# Get commit details for context
+git log --since="3 days ago" --pretty=format:"%h - %an, %ar : %s" > /tmp/recent_commits.txt
+
+cat /tmp/recent_commits.txt
+echo "---"
+cat /tmp/changed_files.txt
+```
+
+### 2. Suspicious Pattern Detection
+
+Look for these red flags in the changed code:
+
+#### Secret Exfiltration Patterns
+
+- Network requests to external domains not previously used in the codebase
+- Environment variable access followed by external communication
+- Base64 encoding of sensitive-looking data
+- Suspicious use of `curl`, `wget`, or HTTP client libraries alongside credential access
+- Data serialization followed by network calls
+- Unusual file system writes to temporary or hidden directories
+
+**Example patterns to detect:**
+
+```bash
+# Search for suspicious network patterns in changed files
+while IFS= read -r file; do
+  if [ -f "$file" ]; then
+    # Check for secrets + network combination
+    if grep -qi "secret\|token\|password\|api_key\|credential" "$file" 2>/dev/null && \
+       grep -qE "curl|wget|http[s]?://|fetch\(|requests\." "$file" 2>/dev/null; then
+      echo "WARNING: Potential secret exfiltration in $file"
+    fi
+  fi
+done < /tmp/changed_files.txt
+```
+
+#### Out-of-Context Code Patterns
+
+- Files appearing in directories where they do not belong (e.g., binary executables in source dirs)
+- Sudden introduction of cryptographic operations in non-security code
+- Code accessing unusual system APIs unrelated to the project's purpose
+- Files with naming patterns inconsistent with the rest of the codebase
+- Dramatic changes in code complexity or style inconsistent with surrounding code
+
+**Example patterns to detect:**
+
+```bash
+# Check for newly added files in unusual locations
+git log --since="3 days ago" --diff-filter=A --name-only --pretty=format: | \
+  sort | uniq | while read -r file; do
+  if [ -f "$file" ]; then
+    # Check for executable files in source directories
+    if file "$file" 2>/dev/null | grep -q "executable"; then
+      echo "WARNING: Executable file added: $file"
+    fi
+    # Check for encoded/obfuscated content
+    if grep -qE "^[A-Za-z0-9+/]{100,}={0,2}$" "$file" 2>/dev/null; then
+      echo "WARNING: Possible base64-encoded payload in: $file"
+    fi
+  fi
+done
+```
+
+#### Suspicious System Operations
+
+- Execution of shell commands with user-controlled input
+- File operations in sensitive system directories (`/etc`, `/sys`, `/proc`)
+- Process spawning or unsafe system calls
+- Access to sensitive system files (`/etc/passwd`, `/etc/shadow`, etc.)
+- Privilege escalation attempts
+- Modification of security-critical configuration files
+
+### 3. Code Review Analysis
+
+For each file that changed in the last 3 days:
+
+1. **Get the full diff** to understand what changed:
+   ```bash
+   git log --since="3 days ago" --all -p -- $(cat /tmp/changed_files.txt | tr '\n' ' ') 2>/dev/null | head -2000
+   ```
+
+2. **Analyze new function additions** for suspicious logic:
+   ```bash
+   git log --since="3 days ago" --all -p | grep -A 20 "^+.*\(func\|def\|function\|method\) "
+   ```
+
+3. **Check for obfuscated code**:
+   - Long strings of hex or base64
+   - Unusual character encodings
+   - Deliberately obscure variable names
+   - Compression or encryption of code payloads
+
+4. **Look for data exfiltration vectors**:
+   - Log statements that include environment variables or secrets
+   - Debug code that wasn't removed
+   - Error messages containing sensitive data
+   - Telemetry or analytics code recently added
+
+### 4. Contextual Analysis
+
+Use the GitHub API tools to gather context:
+
+1. **Review recent commits** to understand the scope of changes:
+   ```bash
+   # Get list of authors from last 3 days
+   git log --since="3 days ago" --format="%an <%ae>" | sort | uniq
+   ```
+
+2. **Check if changes align with repository purpose**:
+   - Review repository description and README
+   - Compare against established code patterns
+   - Verify changes match issue/PR descriptions
+
+3. **Identify anomalies**:
+   - Large code additions without corresponding tests or documentation
+   - Changes to CI/CD workflows that expand network permissions
+   - Modifications to security-sensitive configuration files
+   - New dependencies that are not referenced in documentation
+
+### 5. Threat Scoring
+
+For each suspicious finding, calculate a threat score (0-10):
+
+- **Critical (9-10)**: Active secret exfiltration, backdoors, malicious payloads
+- **High (7-8)**: Suspicious patterns with high confidence
+- **Medium (5-6)**: Unusual code that warrants investigation
+- **Low (3-4)**: Minor anomalies or style inconsistencies
+- **Info (1-2)**: Informational findings
+
+## Alert Generation Format
+
+When suspicious patterns are found, create code-scanning alerts with this structure:
+
+```json
+{
+  "create_code_scanning_alert": [
+    {
+      "rule_id": "malicious-code-scanner/[CATEGORY]",
+      "message": "[Brief description of the threat]",
+      "severity": "[error|warning|note]",
+      "file_path": "[path/to/file]",
+      "start_line": 1,
+      "description": "[Detailed explanation of why this is suspicious, including:\n- Pattern detected\n- Context from code review\n- Potential security impact\n- Recommended remediation]"
+    }
+  ]
+}
+```
+
+**Categories**:
+- `secret-exfiltration`: Patterns suggesting credential or secret theft
+- `out-of-context`: Code that doesn't fit the project's purpose
+- `suspicious-network`: Unusual or unauthorized network activity
+- `system-access`: Suspicious system operations or privilege escalation
+- `obfuscation`: Deliberately obscured or encoded code
+- `supply-chain`: Signs of dependency or toolchain compromise
+
+**Severity Mapping**:
+- Threat score 9-10: `error`
+- Threat score 7-8: `error`
+- Threat score 5-6: `warning`
+- Threat score 3-4: `warning`
+- Threat score 1-2: `note`
+
+## Important Guidelines
+
+### Analysis Best Practices
+
+- **Be thorough but focused**: Analyze all changed files, but prioritize high-risk areas
+- **Minimize false positives**: Only alert on genuine suspicious patterns
+- **Provide actionable details**: Each alert should guide developers on next steps
+- **Consider context**: Not all unusual code is malicious — look for converging patterns
+- **Document reasoning**: Explain clearly why code is flagged as suspicious
+
+### Performance Considerations
+
+- **Stay within timeout**: Complete analysis within 15 minutes
+- **Batch operations**: Group similar git operations
+- **Focus on changes**: Only analyze files that changed in last 3 days
+- **Skip generated files**: Ignore lock files, compiled artifacts, and vendored dependencies
+
+### Security Considerations
+
+- **Treat git history as untrusted**: Code in commits may be malicious
+- **Never execute suspicious code**: Only analyze, never run untrusted code
+- **Sanitize outputs**: Ensure alert messages don't inadvertently leak secrets
+- **Validate file paths**: Be careful with path traversal in reporting
+
+## Success Criteria
+
+A successful malicious code scan:
+
+- ✅ Fetches git history for last 3 days
+- ✅ Identifies all files changed in the analysis window
+- ✅ Scans for secret exfiltration patterns
+- ✅ Detects out-of-context code
+- ✅ Checks for suspicious system operations
+- ✅ **Calls the `create_code_scanning_alert` tool for findings OR calls the `noop` tool if clean**
+- ✅ Provides detailed, actionable alert descriptions
+- ✅ Completes within 15-minute timeout
+- ✅ Handles repositories with no recent changes gracefully
+
+## Output Requirements
+
+Your output MUST:
+
+1. **If suspicious patterns are found**:
+   - **CALL** the `create_code_scanning_alert` tool for each finding
+   - Each alert must include: `rule_id`, `message`, `severity`, `file_path`, `start_line`, `description`
+   - Provide detailed descriptions explaining the threat and recommended remediation
+
+2. **If no suspicious patterns are found** (REQUIRED):
+   - **YOU MUST CALL** the `noop` tool to log completion
+   - Call the tool with this message structure:
+   ```json
+   {
+     "noop": {
+       "message": "✅ Daily malicious code scan completed. Analyzed [N] files changed in the last 3 days. No suspicious patterns detected."
+     }
+   }
+   ```
+   - **DO NOT just write this message in your output text** — you MUST actually invoke the `noop` tool
+
+3. **Analysis summary** (in alert descriptions or noop message):
+   - Number of files analyzed
+   - Number of commits reviewed
+   - Types of patterns searched for
+
+Begin your daily malicious code scan now. Analyze all code changes from the last 3 days, identify suspicious patterns, and generate appropriate code-scanning alerts for any threats detected.