Two hardening notes from a blind pre-registered read at ea1579f: AgenticUserId skips ValidateGuid before an az shell-out; config secret has no file-mode hardening on macOS/Linux

[blu400codes]

I run independent, pre-registered verification of AI-built systems (Trenyx; the published engagements are at https://trenyx.io/audits.html). I did a static-only read of microsoft/Agent365-devTools at commit ea1579f with the attack plan hashed and anchored before I opened a line of source. Nothing here crosses a security boundary (both items need write access to the user's own files), so this is a hardening note, not a vulnerability report. The MSAL-delegated auth, delegated-only flows, setup privilege scope, manifest handling and query-entra paths all held as documented, and the suite is real (about 1,700 Fact/Theory cases across 132 files).

1. AgenticUserId is the one identifier on Agent365Config that ConfigService never runs through ValidateGuid. Its siblings all are: TenantId (ConfigService.cs:391), ManagedIdentityPrincipalId (:399), AgenticAppId (:406), BotId (:412), BotMsaAppId (:416). The unvalidated value is then interpolated into az ad user delete --id {config.AgenticUserId} at CleanupCommand.cs:811 and :1113, and CommandExecutor.cs:37-41 wraps az in cmd.exe /c on Windows. The value comes from a365.generated.config.json, which your docs describe as CLI-managed and gitignored (docs/design.md:134), so only someone who can already write the user's state file can plant it. A one-line ValidateGuid on AgenticUserId gives the family parity and closes the gap on principle.

2. On macOS and Linux the client secret is stored in plaintext (SecretProtectionHelper.cs:44-48 warns at write time), and no file-mode hardening is applied to the config files that hold it; the CLI's own MSAL cache documents 0600 on Linux. Writing the config files with UnixFileMode 0600 (or chmod after write) would match that precedent.

Happy to re-check either change. The pre-registration hash and the full record publish on the audits page with the read.

SK
Trenyx

[github-actions]

[AUTO-TRIAGE] Team Assistant Triage

This issue has been automatically analyzed and triaged.

AI Decision Reasoning: Type: Classified as 'feature' because the issue suggests improvements to the security hardening of the system, rather than reporting a bug or incorrect behavior.
Priority: Elevated to P1 due to security concern: Security keywords detected: vulnerability, security, attack
Copilot: Security issues require human review and should not be auto-fixed
Assignment: Security issue assigned to security lead. Security keywords detected: vulnerability, security, attack
Labels: Applied labels enhancement, P1, security based on issue type and priority

Labels and assignee have been applied based on this analysis.

[github-actions]

[AUTO-TRIAGE] Results

Classification: feature
Priority: P1
Confidence: 90.0%

Recommended Assignee: ajmfehr

Analysis:
type rationale: Classified as 'feature' because the issue suggests improvements to the security hardening of the system, rather than reporting a bug or incorrect behavior.

priority rationale: Elevated to P1 due to security concern: Security keywords detected: vulnerability, security, attack

copilot rationale: Security issues require human review and should not be auto-fixed

assignment rationale: Security issue assigned to security lead. Security keywords detected: vulnerability, security, attack

labels rationale: Applied labels enhancement, P1, security based on issue type and priority

[SUGGESTION] Suggested Approach

1. 1. **Add `ValidateGuid` for `AgenticUserId` in `ConfigService`**: In `src/Services/ConfigService.cs`, locate the method where `AgenticUserId` is processed (likely near lines 391-416 based on the issue description). Add a call to `ValidateGuid` for `AgenticUserId`, similar to how it is done for `TenantId`, `ManagedIdentityPrincipalId`, `AgenticAppId`, `BotId`, and `BotMsaAppId`. This ensures consistency and prevents invalid GUIDs from being used in shell commands.
2. 2. **Harden file permissions for config files on macOS/Linux**: In `src/Services/SecretProtectionHelper.cs`, modify the logic in the section around lines 44-48 to explicitly set file permissions to `0600` (read/write for the owner only) when writing the client secret or other sensitive config files. Use the `System.IO.File.SetAttributes` method or a similar approach to enforce this file mode.
3. 3. **Add unit tests for `ValidateGuid` and file permission changes**: In `src/Tests/Microsoft.Agents.A365.DevTools.Cli.Tests/MockToolingServer` or a relevant test directory, create test cases to verify that `AgenticUserId` is properly validated using `ValidateGuid`. Additionally, add tests to confirm that config files are written with the correct permissions (e.g., `0600`) on macOS/Linux.
4. 4. **Update documentation to reflect hardening changes**: In `docs/design.md`, update the relevant section (likely around line 134) to describe the new validation for `AgenticUserId` and the file permission hardening for config files. This ensures users and contributors are aware of these changes and their implications.
5. 5. **Perform a security review of other shell-out commands**: Review all instances where user-provided or config-derived values are interpolated into shell commands (e.g., `az` commands in `CleanupCommand.cs` and `CommandExecutor.cs`). Ensure that all inputs are properly validated or sanitized to prevent potential command injection vulnerabilities.

---

Generated by TeamAssistant Auto-Triage powered by GitHub Models

[github-actions]

SLA Escalation Alert

This P1 issue has exceeded its SLA threshold.

Metric	Value
Priority	P1
SLA Threshold	48 hours
Time Since Update	61.3 hours
Current Assignees	ajmfehr

Action: This issue is already assigned to a Tech Lead but remains unresolved.

Escalating to Engineering Manager ajmfehr for visibility.

Tech Leads: ajmfehr

---

Generated by AutoTriage SLA Escalation