[uk ai resilience] UK AI Governance: Weekly Recent-Change Risk & Resilience Report (2026-08-26)

[github-actions[bot]]

Executive summary

Recent-change-scoped review of github/gh-aw (7-day lookback since 2026-08-19; 504 commits, 183 security-signal commits). No open secret-scanning alerts. 6 open code-scanning alerts, all previously unresolved; 37 open security-labeled issues, several long-aged (ASI-06/#28775, ASI-08/#28776, #19967, #5437). The team shows strong recent remediation velocity (govulncheck CI gate, depguard rule vs. unmaintained x/crypto/openpgp, zizmor Docker hardening, template-injection grep replaced by parsed workflow check, safe-outputs API-storm fail-fast). Highest-priority gaps are two recurring code-scanning findings already tracked (Tier B/C) plus systemic gaps in prompt-injection sanitization and workflow failure circuit-breaking that remain open despite being flagged long ago. Note: the asset-tier-classifier, control-verifier, and ai-risk-scorer sub-agents did not return output after one retry each; this report was synthesized directly from precomputed inputs (recent commits, security-signal commits, open security issues, code-scanning/secret-scanning alerts) with reduced confidence on tiering nuance.

Asset graph summary (recent-change scoped)

Recent-change scoped assets

Area	Signal
pkg/cli package-manifest generation (add_package_manifest.go)	CodeQL go/bad-redirect-check (#656), tracked in issue #54037
GraphQL query builder (project_command.go)	CodeQL workflow-go-graphql-injection-sprintf (#651, #652), tracked in issue #52749
scripts/ensure-docs-slide-pdf.js	Untrusted network data written to file, js/http-to-file-access (#654), tracked in issue #53737
Workflow lint/context (actionlint)	workflow-out-of-context (#653)
README.md	workflow-security-finding-1 (#564)
gh-aw-firewall images (agent/squid/cli-proxy/api-proxy), gh-aw-mcpg, github-mcp-server, node:lts-alpine	Recurring container-image-scan issues, no clear closure cadence
safe-outputs pipeline / CI gates	Recent hardening: govulncheck, depguard, zizmor, template-injection parsing, API-storm fail-fast
Repo-memory / cache-memory content handling	Prompt-injection sanitization gap (#28775, #5437)
Workflow failure handling	No circuit breaker for repeatedly failing workflows (#28776); recently patched a related symptom (#55957)

Ownership signal: commits are dominated by github-actions[bot] (automated reports/PRs) and human maintainer pelikhan, with copilot-swe-agent[bot] co-authoring fixes — single-maintainer review bottleneck risk.

Tier classification table

Tier classification

Area	Tier	Rationale
add_package_manifest.go redirect check	B	Error-severity CodeQL finding, already tracked (#54037), low exploit complexity but limited blast radius (manifest add flow)
project_command.go GraphQL sprintf construction	B	Warning-severity, injection-adjacent pattern, already tracked (#52749), needs parameterization verification
scripts/ensure-docs-slide-pdf.js untrusted write	C	Untrusted network data to file, already flagged Tier C (#53737), doc-build script but could affect CI artifacts
actionlint workflow-out-of-context (#653)	A	Lint-level warning, low exploitability
README.md workflow-security-finding-1 (#564)	A	Documentation-only finding
Container images (firewall/mcpg/mcp-server/node)	B	Recurring scan issues without visible closure SLA; used in production proxy path
Prompt-injection sanitization gaps (#28775/#19967/#5437)	C	Long-open (issue numbers indicate age), directly relevant to AI agent trust boundary, no recent progress signal
Workflow circuit breaker (#28776)	B	Related failure mode already surfaced once in practice (#55957 fix), mitigation still generic/not implemented

Control verification gaps

• Ownership: Partial — heavy reliance on one human maintainer (pelikhan) reviewing bot-generated PRs; no secondary reviewer/escalation path visible in commit metadata.
• SDLC controls: Adequate and improving — govulncheck gate, depguard rule, zizmor hardening, parsed-workflow template-injection check all added within the window.
• Dependency controls: Partial — Go module gating strong (govulncheck/depguard); container image scanning produces recurring unresolved findings across firewall/mcpg images without a visible remediation SLA.
• Secret exposure controls: Adequate — 0 open secret-scanning alerts.
• Runtime observability: Partial — debug logging added to pkg/actionpins recently, but no repo-wide evidence of consistent instrumentation across all flagged risk areas (e.g., GraphQL query construction, network-fetch scripts).
• Recovery controls: Gap — no workflow circuit breaker for repeatedly failing workflows (ASI-08: Add circuit breaker for repeatedly failing workflows #28776) despite a related storm incident already occurring and being patched reactively (Fail fast on approve_workflow_run permission denials to stop safe-outputs API storm #55957); patch/rollback readiness for container images unclear given issue backlog.

Risk-scoring table and rationale

Risk scoring (manual, sub-agent unavailable)

Area	Exposure Amplification	Patchability	Detectability	Operational Fragility	Ownership Confidence	Tier
add_package_manifest.go redirect check	Medium	High	High (CodeQL)	Low	Medium	B
project_command.go GraphQL sprintf	Medium	High	High (CodeQL)	Low	Medium	B
ensure-docs-slide-pdf.js untrusted write	Medium	Medium	Medium	Medium	Medium	C
Container images (firewall/mcpg)	Medium	Medium	High (scanner)	Medium	Low	B
Prompt-injection sanitization (#28775/#19967/#5437)	High	Low (design work needed)	Low	High	Low	C
Workflow circuit breaker (#28776)	Medium	Medium	Medium	High	Medium	B

Rationale: prompt-injection sanitization gaps score highest exposure/fragility because they sit directly on the AI-agent trust boundary with no active remediation signal, while CodeQL-flagged code issues (B tier) benefit from high detectability and known fix patterns.

Remediation queue with SLAs

Item	Action	SLA
#54037 go/bad-redirect-check	Add double-slash/backslash-aware redirect validation in add_package_manifest.go	High
#52749 GraphQL sprintf construction	Replace sprintf-built GraphQL queries with parameterized/templated construction in project_command.go	High
#53737 untrusted network write	Validate/sandbox network response before writing in ensure-docs-slide-pdf.js	Medium
Container image backlog	Establish a triage SLA and closure cadence for recurring gh-aw-firewall/gh-aw-mcpg scan issues	Medium
#28775 / #19967 / #5437 prompt-injection sanitization	Design and implement content sanitization for repo-memory/cache-memory and MCP tool content by contributor trust	Critical
#28776 workflow circuit breaker	Implement generic circuit breaker for repeatedly failing workflows, generalizing the #55957 fix	High

Exception register

None proposed this run — no temporary hidden-repo or bypass exceptions are recommended; all findings above map to standard remediation actions, not concealment.

Operational metrics baseline

• MTTR proxy: Recent CI/dependency hardening items (govulncheck, depguard, zizmor) landed within the 7-day window, suggesting sub-week remediation for actively-tracked findings; container-image and prompt-injection issues show multi-month aging (issue numbers from caches should be sanitized #5437–ASI-08: Add circuit breaker for repeatedly failing workflows #28776).
• Ownership coverage: Single primary human reviewer (pelikhan) visible across sampled commits — concentration risk.
• Unsupported dependency ratio: At least one flagged unmaintained dependency (x/crypto/openpgp) now blocked via depguard; container base images (node:lts-alpine, github-mcp-server) show recurring unresolved scan findings.
• Exception aging: No formal exceptions currently registered; long-open issues (caches should be sanitized #5437, Have "santize" mode where GitHub MCP tools box and sanitize text content according to contributor status #19967, ASI-06: Sanitize repo-memory and cache-memory content before prompt injection #28775, ASI-08: Add circuit breaker for repeatedly failing workflows #28776) function as de facto unmanaged exceptions and should be formalized with expiry/mitigation plans.
• Exposure without recovery capability: Workflow circuit breaker gap (ASI-08: Add circuit breaker for repeatedly failing workflows #28776) means repeated workflow failures currently require manual/reactive fixes (as seen with Fail fast on approve_workflow_run permission denials to stop safe-outputs API storm #55957), representing exposure without automated recovery.

Generated by UK AI Operational Resilience · copilot · auto · 39.9 AIC · ⌖ 6.87 AIC · ⊞ 8.1K · ◷

• expires on Aug 29, 2026, 8:02 AM UTC-08:00