[uk ai resilience] [uk-ai-resilience] UK AI Open Code Risk & Resilience Report — 2026-07-21

[github-actions[bot]]

Executive Summary

Weekly UK AI Open Code Risk & Resilience assessment for github/gh-aw covering the 7-day lookback window (2026-07-14 → 2026-07-21). The repository recorded 368 commits and 106 security-signal commits, indicating an active remediation cycle. The posture is Tier B (Open With Conditions) overall — strong SDLC tooling is in place, but multiple injection-class vulnerabilities remain open and the XPIA/cache-memory poisoning surface is still unresolved.

---

Asset Graph Summary (Recent-Change Scoped)

Segment	Key Files Changed	Tier Hypothesis	Primary Risk Signal
CLI injection surface	pkg/cli/ (bootstrap_profile_helpers.go, project_command.go, outcome_eval.go, upgrade_org.go, update_org_search.go, upgrade_command.go, runner_guard.go)	C	Critical unsafe-quoting (#650), GraphQL injection (#641–644), CWE-78 command injection (#46882)
Cache/XPIA memory	pkg/workflow/cache.go, memory layer	C	Cross-run XPIA poisoning (#28830, #28775, #45777)
PAT/token onboarding	gh aw add-wizard	B	repositories:["*"] default scope (#46036)
CI/CD pipeline integrity	.github/workflows/	B	69 workflows with undeclared secret (#46883), unpinned docker action (#625)
SSRF/routing surface	CAPI endpoint routing	B	Reflected endpoint routing SSRF risk (#45776)
Docs/scripts	scripts/ensure-docs-slide-pdf.js	B	HTTP-to-file write (#636)

---

Tier Classification Table

Area	Tier	Rationale
CLI injection surface	C — Restricted Pending Review	Critical CodeQL + multiple injection alerts open, CWE-78 unresolved
Cache/XPIA memory	C — Restricted Pending Review	Agentic cross-run poisoning with no sanitization, AI amplification high
PAT/token onboarding	B — Open With Conditions	Overly broad default scope; fix identified, not merged
CI/CD pipeline integrity	B — Open With Conditions	Unpinned action + 69 undeclared secrets; mitigated by extensive scan tooling
SSRF/routing surface	B — Open With Conditions	Reflected routing; needs architectural review
Docs/scripts	B — Open With Conditions	JS script writes network data to disk; limited blast radius

---

Control Verification Summary

Domain	Status	Evidence	Gaps
Ownership	⚠️ Partial	Single maintainer (pelikhan), active PR reviews	No CODEOWNERS file; no formal team ownership
SDLC	✅ Present	CodeQL, Semgrep, actionlint, zizmor, poutine, Sighthound daily scans	10 open CodeQL alerts; issue velocity high but resolution lagging
Dependency	✅ Present	Dependabot (go, npm ×3, pip), action pin locking, empty-SHA guard added this week	Unpinned docker/build-push-action (#625) open since #44078
Secret exposure	✅ Present	Secret scanning active, 0 open alerts	69 workflows reference undeclared secret_verification_result (#46883)
Runtime observability	✅ Present	OTEL tracing, daily security observability workflow, firewall	Firewall version pinning should be verified
Recovery	⚠️ Partial	Active patch cadence (106 security commits/week), ADRs written	MTTR on Tier C items: XPIA open since Jul 2025 (>6 months), CWE-78 open since this week

---

Risk-Scoring Table

Area	Exposure	Patchability	Detectability	Fragility	Ownership Confidence	Composite (1–10)	Tier	Priority	SLA
CLI unsafe-quoting (#650)	4	4	3	2	3	7.5	C	Critical	7 days
Cache/XPIA poisoning (#45777)	5	2	2	3	3	8.5	C	Critical	14 days
CWE-78 command injection (#46882)	4	3	3	3	3	7.0	C	High	14 days
GraphQL injection (#641–644)	3	4	3	2	3	6.5	B→C	High	14 days
PAT scope (#46036)	3	4	2	2	3	5.5	B	High	14 days
Undeclared secrets (#46883)	3	4	2	2	3	5.0	B	Medium	30 days
Unpinned docker action (#625)	3	5	2	1	3	4.5	B	Medium	30 days
HTTP-to-file JS (#636)	2	4	2	1	2	3.5	B	Low	60 days

AI amplification factors:

• Cache/XPIA ([uk-ai-resilience] [security] Memory/cache XPIA poisoning — consolidate and remediate (#28830, #28775, Tier C Critical) #45777): Agentic cross-run poisoning allows adversarial content from one run to influence future AI model inputs — high autonomy multiplier.
• CLI injection ([Custom Engine Test] Test Issue Created by Custom Engine #650, [uk-ai-resilience] [security] Review CWE-78 command injection in upgrade_command.go and runner_guard.go (Sighthound #46729, Tier [Content truncated due to length] #46882): gh-aw runs in CI/CD agentic pipelines; command injection in bootstrap/upgrade paths could execute arbitrary commands with CI permissions.

---

Remediation Queue with SLAs

#	Finding	Action	SLA	Status
1	CodeQL #650 — critical unsafe-quoting bootstrap_profile_helpers.go:260	Escape state param in fmt.Sprintf URL construction; sanitize registrationURL input	7 days	🆕 New issue created
2	XPIA cache poisoning (#45777)	Implement content sanitization before prompt injection into cache memory	14 days	Open since Jul 2025 — escalate
3	CWE-78 command injection (#46882)	Review upgrade_command.go and runner_guard.go for unvalidated shell expansion	14 days	Tracking issue open
4	GraphQL injection (#641–644, #46277, #45519, #45520)	Use structured API / parameterized queries in outcome_eval.go, upgrade_org.go, update_org_search.go	14 days	Multiple tracking issues open
5	PAT scope (#46036)	Narrow default repositories scope; require explicit opt-in for ["*"]	14 days	Tracking issue open
6	Undeclared secrets actionlint (#46883)	Add secret_verification_result to workflow inputs or rename callers	30 days	Tracking issue open
7	Unpinned docker action (#625, #44078)	Pin docker/build-push-action to SHA in publish-safe-outputs-node.yml	30 days	Tracking issue open (stale)

---

Exception Register

Finding	Threat Hypothesis	Exploit Acceleration	Operational Weakness	Expiry	Mitigation Plan
#625 unpinned docker action	Supply-chain injection via docker/build-push-action compromise	Medium — popular action, targeted by supply-chain attackers	CI pipeline integrity	2026-08-21	Pin to SHA; add Dependabot for action pins
#45777 XPIA poisoning	Adversarial cross-run prompt injection via cache	High — agentic pipelines with elevated permissions are prime targets	No sanitization layer	2026-08-07	Implement content sanitization before cache reads feed into prompts

---

Operational Metrics Baseline

Metric	Value	Target	Status
MTTR proxy (Tier C items)	~6+ months (XPIA #45777)	<30 days	🔴
Ownership coverage	1 active maintainer	≥2	🟡
Unsupported dependency ratio	~1 (unpinned action)	0	🟡
Exception aging	1 item >30 days (#625, #44078 stale)	All <30 days	🟡
Exposure without recovery capability	XPIA: unmitigated	Mitigated	🔴
Security scan coverage	CodeQL + Semgrep + actionlint + zizmor + poutine + Sighthound daily	Comprehensive	🟢
Remediation velocity	106 security-signal commits/week	Active	🟢

---

References

• §29846286340 — this governance run
• CodeQL alert [Custom Engine Test] Test Issue Created by Custom Engine #650: https://github.com/github/gh-aw/security/code-scanning/650
• XPIA tracking: [uk-ai-resilience] [security] Memory/cache XPIA poisoning — consolidate and remediate (#28830, #28775, Tier C Critical) #45777

Generated by UK AI Operational Resilience · sonnet46 88.1 AIC · ⌖ 6.03 AIC · ⊞ 5.2K · ◷

• expires on Jul 24, 2026, 8:05 AM UTC-08:00