kubernetes-sigs / kubernetes-sigs/devops-bench
feat(harness): Sanitize environment variables and breadcrumbs in subprocess execution
Open
- Dominant language
- Python
- Stars
- 29
- Forks
- 15
- Avg merge
- 6d 3h
- Merged PRs (30d)
- 15
Description
### Summary
Shell-capable agents can inspect inherited environment variables (such as `KUBECONFIG` paths containing task names and layout paths) to backtrace task directories.
### Scope
1. Sanitize inherited environment variables passed to agent subprocesses.
2. Obfuscate ephemeral run IDs and file paths.
Ref: Internal bug b/552484094
Contributor guide
Research direction
No files or tests are named. Start by locating the harness entry point that launches agent subprocesses and trace how inherited environment variables are passed; done means task-specific paths and ephemeral run IDs are no longer exposed through variables or breadcrumbs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- devops, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 48/100