🔍 Static Analysis Report - 2026-08-21
Analysis Summary
- Tools Used: zizmor, poutine, actionlint, runner-guard, syft, grype, yamllint, shellcheck
- Total Findings: 873 (850 grype container CVEs + 23 workflow-level findings)
- Workflows Scanned: 286 (286 succeeded, 333 compiler warnings)
- Workflows Affected: 14 (by zizmor/poutine/runner-guard) + 10 container images (by grype/syft)
Findings by Tool
| Tool |
Total |
Critical |
High |
Medium |
Low |
| zizmor (security) |
9 |
0 |
0 |
0 |
9 (note) |
| poutine (supply chain) |
1 |
0 |
0 |
0 |
1 (warning) |
| actionlint (linting) |
0 |
- |
- |
- |
- |
| runner-guard (taint analysis) |
13 |
0 |
1 |
12 |
0 |
| syft (SBOM inventory) |
10 images / 3,694 packages |
- |
- |
- |
- |
| grype (container CVEs) |
850 |
51 |
183 |
512 |
104 |
| yamllint (yaml linting) |
0 |
- |
- |
- |
- |
| shellcheck (shell linting) |
0 |
- |
- |
- |
- |
Clustered Findings by Tool and Type
Zizmor Security Findings
| Issue Type |
Severity |
Count |
Affected Workflows |
github_action_from_unverified_creator_used |
Note (suppressed via inline # zizmor: ignore comment, still surfaced for audit) |
9 |
link-check.yml (x2), dataflow-pr-discussion-dataset.lock.yml, super-linter.lock.yml, hippo-embed.lock.yml, smoke-codex.lock.yml, daily-agentrx-trace-optimizer.lock.yml, copilot-setup-steps.yml, daily-elixir-credo-snippet-audit.lock.yml |
All 9 are pre-reviewed and explicitly suppressed at the source with # zizmor: ignore[...] comments; zizmor still reports them at note level for audit visibility. No action required beyond periodic re-review of the suppression list.
Poutine Supply Chain Findings
| Issue Type |
Severity |
Count |
Affected Workflows |
pr_runs_on_self_hosted |
Warning |
1 |
smoke-copilot-arm.lock.yml (runs-on: ubuntu-24.04-arm) |
This is a smoke-test workflow intentionally exercising an ARM runner; low risk but worth confirming the trigger can't be abused to run arbitrary code on that runner from a fork PR.
Actionlint Linting Issues
No issues found across all 286 workflows.
Syft SBOM Inventory
Container image package inventory (10 images, 3,694 packages)
| Image |
Packages |
| ghcr.io/oraios/serena:latest |
1,711 |
| ghcr.io/github/gh-aw-firewall/agent:0.28.2 |
531 |
| ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.2 |
348 |
| ghcr.io/github/gh-aw-mcpg:v0.4.10 |
288 |
| ghcr.io/github/gh-aw-firewall/api-proxy:0.28.2 |
193 |
| grafana/mcp-grafana:1.1.0-alpine |
178 |
| ghcr.io/github/gh-aw-node |
177 |
| node:lts-alpine |
165 |
| ghcr.io/github/gh-aw-firewall/squid:0.28.2 |
63 |
| ghcr.io/github/github-mcp-server:v1.9.0 |
40 |
serena:latest is by far the largest attack surface (1,711 packages, floating latest tag) — worth pinning to a digest if not already resolved at build time.
Runner-Guard Taint Analysis Findings
Runner-Guard Score: not reported in this run's output (no explicit Score/Grade line emitted)
| Rule ID |
Name |
Severity |
Count |
Affected Workflows |
| RGS-012 |
Secret Exfiltration via Outbound HTTP Request |
High |
1 |
visual-regression-checker.lock.yml |
| RGS-005 |
Excessive Permissions on Untrusted Trigger |
Medium |
12 |
ai-moderator.lock.yml (x5), q.lock.yml (x3), squad.lock.yml (x3), agentic_commands.yml (x1) |
Issues created: none (see dedup notes below) — comment added to #54157
Dedup notes:
- RGS-012 in
visual-regression-checker.lock.yml matches an open existing issue, #54157, which already documents this as a likely false positive (the flagged line is a comment listing allowed loopback curl targets for the Copilot CLI, not exfiltration code). A recurrence comment was added instead of opening a duplicate.
- RGS-005 findings are Medium severity, below the Critical/High threshold for automatic issue creation — reported here for visibility only.
Grype Container Vulnerability Findings
| Package |
Severity |
Count |
Affected Images |
| tar |
Critical/High/Medium |
49 |
multiple (node-based images) |
| stdlib (Go) |
High/Medium |
31 |
ghcr.io/github/gh-aw-mcpg, others built with Go |
| perl-base / perl |
Medium |
60 combined |
ghcr.io/oraios/serena:latest |
| bind9-libs |
Medium |
29 |
ghcr.io/oraios/serena:latest |
| node |
Medium |
26 |
node-based images |
| libexpat1 |
Medium |
26 |
ghcr.io/oraios/serena:latest |
| undici |
Medium |
19 |
node-based images |
| ip-address |
High |
17 |
node-based images |
| libcrypto3 / libssl3 |
High (CVE-2026-14456) |
15 combined |
grafana/mcp-grafana:1.1.0-alpine |
Grype findings by image
| Image |
Critical |
High |
Medium |
Low |
| ghcr.io/oraios/serena:latest |
50 |
127 |
153 |
32 |
| ghcr.io/github/gh-aw-firewall/agent:0.28.2 |
0 |
3 |
294 |
62 |
| ghcr.io/github/gh-aw-mcpg:v0.4.10 |
0 |
22 |
14 |
7 |
| node:lts-alpine |
1 |
8 |
12 |
2 |
| ghcr.io/github/gh-aw-firewall/api-proxy:0.28.2 |
0 |
5 |
11 |
0 |
| ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.2 |
0 |
5 |
10 |
0 |
| ghcr.io/github/gh-aw-node |
0 |
3 |
9 |
0 |
| ghcr.io/github/github-mcp-server:v1.9.0 |
0 |
5 |
5 |
1 |
| ghcr.io/github/gh-aw-firewall/squid:0.28.2 |
0 |
3 |
4 |
0 |
| grafana/mcp-grafana:1.1.0-alpine |
0 |
2 |
0 |
0 |
ghcr.io/oraios/serena:latest accounts for ~44% of all grype findings (362/850) and all 51 Critical findings bar one — driven mostly by an outdated tar and a large bundled Perl/bind9 toolchain. Rebuilding/repinning this image against a current upstream base would meaningfully move the needle.
Yamllint YAML Linting Findings
No issues found across all 286 workflows.
Shellcheck Shell Linting Findings
No issues found across all 286 workflows.
Top Priority Issues
1. Container CVEs in ghcr.io/oraios/serena:latest
- Tool: grype
- Count: 362 (50 Critical, 127 High, 153 Medium, 32 Low)
- Severity: Critical
- Affected: all workflows using the Serena MCP tool
- Description: Floating
latest tag pulls in a large (1,711-package) image with an outdated tar and legacy Perl/bind9 packages carrying multiple CVEs, including 4 GHSA-23hp-3jrh-7fpw (tar, Critical).
- Impact: Largest single source of exploitable CVEs in the fleet; a floating tag also means the vulnerable set can silently grow between runs.
- Reference: GHSA-23hp-3jrh-7fpw
2. RGS-005: Excessive Permissions on Untrusted Trigger
- Tool: runner-guard
- Count: 12 (across 4 workflows)
- Severity: Medium
- Affected: ai-moderator.lock.yml, q.lock.yml, squad.lock.yml, agentic_commands.yml
- Description: Jobs triggered by
pull_request_target/issue_comment-style events declare write-level permissions: at the top of the workflow.
- Impact: Expands blast radius if any future code-execution bug (expression injection, fork checkout) is introduced — write permissions become directly exploitable.
- Reference: https://github.com/Vigilant-LLC/runner-guard
3. RGS-012: Secret Exfiltration via Outbound HTTP Request (recurring, likely false positive)
Fix Suggestion for RGS-005: Excessive Permissions on Untrusted Trigger
Issue: Jobs triggered by untrusted events (issue_comment, pull_request_target, etc.) declare write-level permissions: instead of read-only + safe-outputs.
Severity: Medium
Affected Workflows: 4 workflows / 12 occurrences (ai-moderator.lock.yml, q.lock.yml, squad.lock.yml, agentic_commands.yml)
Prompt to Copilot Agent:
You are fixing a security finding identified by runner-guard (RGS-005: Excessive Permissions on
Untrusted Trigger).
**Vulnerability**: A job specifies `permissions:` with write-level access (contents: write,
packages: write, id-token: write, actions: write, deployments: write, or similar) but the
workflow is triggered by an event an external user can initiate (issue_comment,
pull_request_target, pull_request_review_comment, slash commands from bots, etc.). Write
permissions here expand the blast radius of any future code-execution bug from
"read some data" to "modify the repo, publish a package, or assume a cloud identity."
**Rule**: RGS-012 - https://github.com/Vigilant-LLC/runner-guard
**Current Issue**:
The workflow's top-level (or job-level) `permissions:` block grants write scopes even though
the actual work the agent needs to do (posting a comment, creating an issue, pushing to a PR
branch) is already handled by gh-aw's safe-outputs mechanism, which uses its own
narrowly-scoped token. The ambient workflow permissions are broader than what the job body
actually needs.
**Required Fix**:
1. Identify what the job body actually does with the token directly (vs. via safe-outputs).
2. Set the workflow/job `permissions:` block to the minimum required — typically
`contents: read` plus only the specific read scopes the toolset needs (e.g. `issues: read`,
`pull-requests: read`).
3. Route any writes (comments, labels, issues, PR pushes) through the existing safe-outputs
tools rather than granting the job a write token.
4. Re-run `gh aw compile` (or the project's equivalent) and confirm runner-guard no longer
flags RGS-005 for the changed workflow.
**Example**:
Before:
```yaml
on:
issue_comment:
types: [created]
permissions:
contents: write
issues: write
pull-requests: write
jobs:
agent:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
# ... agent runs, posts comments/labels directly with GITHUB_TOKEN
After:
on:
issue_comment:
types: [created]
permissions:
contents: read
issues: read
pull-requests: read
jobs:
agent:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
# ... agent runs; comments/labels are emitted via safe-outputs (add_comment, etc.)
# which use a separately-scoped token, not the job's own GITHUB_TOKENPlease apply this fix to: ai-moderator.lock.yml (and its source .md), q.lock.yml (and its
source .md), squad.lock.yml (and its source .md), agentic_commands.yml.
<details>
<summary><b>All Findings Details</b></summary>
#### visual-regression-checker.lock.yml
##### RGS-012: Secret Exfiltration via Outbound HTTP Request
- **Severity**: High
- **Location**: Line 879
- **Description**: Outbound HTTP request pattern detected in a comment enumerating Copilot CLI allow-tool entries (`curl (host.docker.internal/...)`, `curl (localhost/...)`) inside a job with secrets access.
- **Reference**: https://github.com/Vigilant-LLC/runner-guard — tracked in #54157 as likely false positive.
#### ai-moderator.lock.yml / q.lock.yml / squad.lock.yml / agentic_commands.yml
##### RGS-005: Excessive Permissions on Untrusted Trigger
- **Severity**: Medium
- **Location**: Line 1 (workflow-level `permissions:`)
- **Description**: Write-level permissions declared alongside an untrusted trigger (issue_comment / pull_request_target-style events).
- **Reference**: https://github.com/Vigilant-LLC/runner-guard
#### smoke-copilot-arm.lock.yml
##### pr_runs_on_self_hosted (poutine)
- **Severity**: Warning
- **Location**: Line 481
- **Description**: `runs-on: ubuntu-24.04-arm` flagged as a non-standard/self-hosted-style runner reachable from a PR-triggered workflow.
- **Reference**: (poutine.dev/redacted)
#### link-check.yml, dataflow-pr-discussion-dataset.lock.yml, super-linter.lock.yml, hippo-embed.lock.yml, smoke-codex.lock.yml, daily-agentrx-trace-optimizer.lock.yml, copilot-setup-steps.yml, daily-elixir-credo-snippet-audit.lock.yml
##### github_action_from_unverified_creator_used (zizmor)
- **Severity**: Note (already suppressed via inline ignore comments)
- **Description**: Third-party actions from creators zizmor doesn't recognize as verified (e.g. `gaurav-nelson/github-action-markdown-link-check`, `safedep/pmg`, `super-linter/super-linter`, `astral-sh/setup-uv`, `erlef/setup-beam`, `actions-ecosystem/action-add-labels`), all pinned to a full commit SHA and explicitly acknowledged with `# zizmor: ignore[...]`.
- **Reference**: (woodruffw.github.io/redacted)
</details>
### Historical Trends
No previous scan data was found in cache memory — this is the first recorded run. Baseline established:
- **Total Findings**: 873 (850 grype + 23 workflow-level)
- **Grype**: 51 Critical / 183 High / 512 Medium / 104 Low
- **Workflow-level (zizmor + poutine + runner-guard)**: 23 (9 zizmor note, 1 poutine warning, 12 RGS-005 medium, 1 RGS-012 high)
Future scans will diff against `/tmp/gh-aw/cache-memory/vulnerabilities/trends.json`.
### Recommendations
1. **Immediate**: Confirm the RGS-012 finding stays classified as a false positive, or fix the underlying heuristic to exclude loopback addresses / comment-only lines (tracked in #54157).
2. **Short-term**: Apply the RGS-005 fix template above to ai-moderator.lock.yml, q.lock.yml, squad.lock.yml, and agentic_commands.yml (drop write permissions on untrusted triggers, rely on safe-outputs).
3. **Medium-term**: Repin `ghcr.io/oraios/serena:latest` to a specific digest and evaluate a smaller/updated base image — it alone accounts for ~44% of all grype findings and nearly all Critical CVEs.
4. **Long-term**: Track grype CVE counts per image over time in cache memory; treat a rising Critical/High count on any pinned image as a signal to bump the pin.
5. **Prevention**: Keep using inline `# zizmor: ignore[...]` with a documented rationale for accepted findings (already the pattern in this repo) so audits stay lightweight.
### Next Steps
- [ ] Apply the RGS-005 fix template to the 4 affected workflows
- [ ] Resolve or fix the RGS-012 heuristic (loopback/comment-line false positive) — see #54157
- [ ] Repin/rebuild `ghcr.io/oraios/serena:latest` to reduce Critical/High CVE count
- [ ] Review whether `pr_runs_on_self_hosted` on smoke-copilot-arm.lock.yml is intentional and safely scoped
- [ ] Re-run this scan next cycle and compare against the newly-created trends baseline
**References:**
- [§32448392658](https://github.com/github/gh-aw/actions/runs/32448392658)
> Generated by [📊 Static Analysis Report](https://github.com/github/gh-aw/actions/runs/32448392658) · agent · 152.2 AIC · ⌖ 14.2 AIC · ⊞ 11.5K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fstatic-analysis-report%22&type=issues)
> - [x] expires <!-- gh-aw-expires: 2026-08-28T05:19:40.677Z --> on Aug 27, 2026, 9:19 PM UTC-08:00
<!-- gh-aw-agentic-workflow: Static Analysis Report, engine: claude, model: agent, id: 32448392658, workflow_id: static-analysis-report, run: https://github.com/github/gh-aw/actions/runs/32448392658 -->
<!-- gh-aw-workflow-id: static-analysis-report -->
<!-- gh-aw-workflow-call-id: github/gh-aw/static-analysis-report -->
🔍 Static Analysis Report - 2026-08-21
Analysis Summary
Findings by Tool
Clustered Findings by Tool and Type
Zizmor Security Findings
github_action_from_unverified_creator_used# zizmor: ignorecomment, still surfaced for audit)All 9 are pre-reviewed and explicitly suppressed at the source with
# zizmor: ignore[...]comments; zizmor still reports them at note level for audit visibility. No action required beyond periodic re-review of the suppression list.Poutine Supply Chain Findings
pr_runs_on_self_hostedruns-on: ubuntu-24.04-arm)This is a smoke-test workflow intentionally exercising an ARM runner; low risk but worth confirming the trigger can't be abused to run arbitrary code on that runner from a fork PR.
Actionlint Linting Issues
No issues found across all 286 workflows.
Syft SBOM Inventory
Container image package inventory (10 images, 3,694 packages)
serena:latestis by far the largest attack surface (1,711 packages, floatinglatesttag) — worth pinning to a digest if not already resolved at build time.Runner-Guard Taint Analysis Findings
Runner-Guard Score: not reported in this run's output (no explicit Score/Grade line emitted)
Issues created: none (see dedup notes below) — comment added to #54157
Dedup notes:
visual-regression-checker.lock.ymlmatches an open existing issue, #54157, which already documents this as a likely false positive (the flagged line is a comment listing allowed loopback curl targets for the Copilot CLI, not exfiltration code). A recurrence comment was added instead of opening a duplicate.Grype Container Vulnerability Findings
Grype findings by image
ghcr.io/oraios/serena:latestaccounts for ~44% of all grype findings (362/850) and all 51 Critical findings bar one — driven mostly by an outdatedtarand a large bundled Perl/bind9 toolchain. Rebuilding/repinning this image against a current upstream base would meaningfully move the needle.Yamllint YAML Linting Findings
No issues found across all 286 workflows.
Shellcheck Shell Linting Findings
No issues found across all 286 workflows.
Top Priority Issues
1. Container CVEs in
ghcr.io/oraios/serena:latestlatesttag pulls in a large (1,711-package) image with an outdatedtarand legacy Perl/bind9 packages carrying multiple CVEs, including 4 GHSA-23hp-3jrh-7fpw (tar, Critical).2. RGS-005: Excessive Permissions on Untrusted Trigger
pull_request_target/issue_comment-style events declare write-levelpermissions:at the top of the workflow.3. RGS-012: Secret Exfiltration via Outbound HTTP Request (recurring, likely false positive)
curl (host.docker.internal/...)andcurl (localhost/...)trips the non-GitHub-domain heuristic.Fix Suggestion for RGS-005: Excessive Permissions on Untrusted Trigger
Issue: Jobs triggered by untrusted events (
issue_comment,pull_request_target, etc.) declare write-levelpermissions:instead of read-only + safe-outputs.Severity: Medium
Affected Workflows: 4 workflows / 12 occurrences (ai-moderator.lock.yml, q.lock.yml, squad.lock.yml, agentic_commands.yml)
Prompt to Copilot Agent:
After:
Please apply this fix to: ai-moderator.lock.yml (and its source .md), q.lock.yml (and its
source .md), squad.lock.yml (and its source .md), agentic_commands.yml.