
Security-research lab: reproduction of CVE-2025-58371 (GitHub Actions command injection via PR title in Discord PR Notifier), snapshot of RooCodeInc/Roo-Code @ 08a825f9bb0086a88cff5a79b9af4731bba7d076
Automated research artifact — not the upstream project.
This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of
RooCodeInc/Roo-Codeat commit08a825f9bb0086a88cff5a79b9af4731bba7d076(2025-09-04), redistributed under that project's own licence, whose file is included unchanged in this snapshot.The upstream project is not involved, is never targeted, and the vulnerability studied here is already public. Every secret and variable in this repository is a randomly generated dummy value — no real credential is present. Action references and runner images are pinned to what they resolved to on 2025-09-04; see
pinning.mdin the harness output for every change made to the snapshot.Questions or objections: [email protected]
한국어 • Nederlands • Polski • Português (BR) • Русский • Türkçe • Tiếng Việt • 简体中文 • 繁體中文
Roo Code is an AI-powered autonomous coding agent that lives in your editor. It can:
Whether you’re seeking a flexible coding partner, a system architect, or specialized roles like a QA engineer or product manager, Roo Code can help you build software more efficiently.
Check out the CHANGELOG for detailed updates and fixes.
Roo Code 3.25 brings powerful new features and significant improvements to enhance your development workflow!
Roo Code adapts to your needs with specialized modes:
Roo Code comes with powerful tools that can:
MCP extends Roo Code's capabilities by allowing you to add unlimited custom tools. Integrate with external APIs, connect to databases, or create specialized development tools - MCP provides the framework to expand Roo Code's functionality to meet your specific needs.
Make Roo Code work your way with:
git clone https://github.com/RooCodeInc/Roo-Code.git
pnpm install
There are several ways to run the Roo Code extension:
For active development, use VSCode's built-in debugging:
Press F5 (or go to Run → Start Debugging) in VSCode. This will open a new VSCode window with the Roo Code extension running.
To build and install the extension as a VSIX package directly into VSCode:
pnpm install:vsix [-y] [--editor=<command>]
This command will:
Options:
-y: Skip all confirmation prompts and use defaults--editor=<command>: Specify the editor command (e.g., --editor=cursor or --editor=code-insiders)If you prefer to install the VSIX package manually:
pnpm vsix
.vsix file will be generated in the bin/ directory (e.g., bin/roo-cline-<version>.vsix).code --install-extension bin/roo-cline-<version>.vsix
We use changesets for versioning and publishing. Check our CHANGELOG.md for release notes.
Please note that Roo Code, Inc does not make any representations or warranties regarding any code, models, or other tools provided or made available in connection with Roo Code, any associated third-party tools, or any resulting outputs. You assume all risks associated with the use of any such tools or outputs; such tools are provided on an "AS IS" and "AS AVAILABLE" basis. Such risks may include, without limitation, intellectual property infringement, cyber vulnerabilities or attacks, bias, inaccuracies, errors, defects, viruses, downtime, property loss or damage, and/or personal injury. You are solely responsible for your use of any such tools or outputs (including, without limitation, the legality, appropriateness, and results thereof).
We love community contributions! Get started by reading our CONTRIBUTING.md.
Thanks to all our contributors who have helped make Roo Code better!
Enjoy Roo Code! Whether you keep it on a short leash or let it roam autonomously, we can’t wait to see what you build. If you have questions or feature ideas, drop by our Reddit community or Discord. Happy coding!
![]() joemanley201 |
![]() System233 |
![]() nissa-seru |
![]() jquanton |
![]() roomote-agent |
![]() NyxJae | ![]() elianiva | ![]() chrarnoldus | ![]() d-oit | ![]() qdaxb | ![]() wkordalski |
![]() xyOz-dev | ![]() punkpeye | ![]() SannidhyaSah | ![]() zhangtony239 | ![]() feifei325 | ![]() cannuri |
![]() monotykamary | ![]() Smartsheet-JB-Brown | ![]() sachasayan | ![]() dtrugman | ![]() liwilliam2021 | ![]() hassoncs |
![]() shariqriazz | ![]() vigneshsubbiah16 | ![]() pugazhendhi-m | ![]() lloydchang | ![]() NaccOll | ![]() Szpadel |
![]() PeterDaveHello | ![]() diarmidmackenzie | ![]() olweraltuve | ![]() psv2522 | ![]() Premshay | ![]() kiwina |
![]() lupuletic | ![]() ChuKhaLi | ![]() aheizi | ![]() afshawnlotfi | ![]() RaySinner | ![]() noritaka1166 |
![]() nbihan-mediware | ![]() brunobergher | ![]() emshvac | ![]() kyle-apex | ![]() pdecat | ![]() Ruakij |
![]() StevenTCramer | ![]() dleffel | ![]() Lunchb0ne | ![]() SmartManoj | ![]() vagadiya | ![]() slytechnical |
![]() dlab-anton | ![]() arthurauffray | ![]() upamune | ![]() NamesMT | ![]() taylorwilsdon | ![]() sammcj |
![]() p12tic | ![]() gtaylor | ![]() catrielmuller | ![]() aitoroses | ![]() benzntech | ![]() ross |
![]() mr-ryan-james | ![]() heyseth | ![]() taisukeoe | ![]() avtc | ![]() eonghk | ![]() GOODBOY008 |
![]() kcwhite | ![]() ronyblum | ![]() teddyOOXX | ![]() thill2323 | ![]() vincentsong | ![]() yongjer |
![]() zeozeozeo | ![]() ashktn | ![]() franekp | ![]() yt3trees | ![]() seedlord | ![]() QuinsZouls |
![]() anton-otee | ![]() axkirillov | ![]() bramburn | ![]() olearycrew | ![]() devxpain | ![]() snoyiatk |
![]() GitlyHallows | ![]() jcbdev | ![]() Chenjiayuan195 | ![]() julionav | ![]() KanTakahiro | ![]() kevint-cerebras |
![]() SplittyDev | ![]() mdp | ![]() napter | ![]() philfung | ![]() pwilkin | ![]() dairui1 |
![]() chris-garrett | ![]() bbenshalom | ![]() bannzai | ![]() axmo | ![]() dqroid | ![]() ershang-fireworks |
![]() f14XuanLv | ![]() janaki-sasidhar | ![]() forestyoo | ![]() hatsu38 | ![]() hongzio | ![]() im47cn |
![]() asychin | ![]() amittell | ![]() Yoshino-Yukitaro | ![]() Yikai-Liao | ![]() zxdvd | ![]() s97712 |
![]() vladstudio | ![]() vivekfyi | ![]() HahaBill | ![]() tmsjngx0 | ![]() TGlide | ![]() Githubguy132010 |
![]() tgfjt | ![]() maekawataiki | ![]() AlexandruSmirnov | ![]() abumalick | ![]() shoopapa | ![]() qingyuan1109 |
![]() refactorthis | ![]() robertheadley | ![]() samir-nimbly | ![]() sensei-woo | ![]() shaybc | ![]() shivamd1810 |
![]() shohei-ihaya | ![]() shubhamgupta731 | ![]() student20880 | ![]() takakoutso | ![]() user202729 | ![]() cdlliuy |
![]() zetaloop | ![]() PretzelVector | ![]() nevermorec | ![]() jues | ![]() jwcraig | ![]() kinandan |
![]() kohii | ![]() lhish | ![]() lightrabbit | ![]() olup | ![]() mecab | ![]() mlopezr |
![]() moqimoqidea | ![]() mosleyit | ![]() nobu007 | ![]() oprstchn | ![]() village-way | ![]() philipnext |
![]() pokutuna | ![]() thecolorblue | ![]() chadgauth | ![]() CW-B-W | ![]() DarinVerheijke | ![]() dleen |
![]() Deon588 | ![]() dflatline | ![]() dbasclpy | ![]() EamonNerbonne | ![]() edwin-truthsearch-io | ![]() ertan2002 |
![]() linegel | ![]() celestial-vault | ![]() ExactDoug | ![]() pfitz | ![]() DeXtroTip | ![]() adambrand |
![]() AMHesch | ![]() adamhill | ![]() adamwlarson | ![]() adilhafeez | ![]() nexon33 | ![]() alarno |
![]() HadesArchitect | ![]() alasano | ![]() andreastempsch | ![]() andrewshu2000 | ![]() AntiMoron | ![]() atlasgong |
![]() Atlogit | ![]() benashby | ![]() bogdan0083 | ![]() hesara | ![]() marvijo-code | ![]() mollux |
![]() ecmasx | ![]() kvokka | ![]() mohammad154 | ![]() Naam | ![]() niteshbalusu11 | ![]() OlegOAndreev |
![]() PaperBoardOfficial | ![]() Sarke | ![]() R-omk | ![]() SECKainersdorfer | ![]() RandalSchwartz | ![]() RSO |
![]() 01Rian | ![]() samsilveira | ![]() jdilla1277 | ![]() Jdo300 | ![]() Fovty | ![]() snova-jorgep |
![]() joshualipman123 | ![]() Juice10 | ![]() AyazKaan | ![]() ksze | ![]() KevinZhao | ![]() kevinvandijk |
![]() Rexarrior | ![]() shtse8 | ![]() libertyteeth | ![]() monkeyDluffy6017 | ![]() mamertofabian | ![]() markijbema |