[static-analysis] Report - 2026-08-28

[github-actions]

🔍 Static Analysis Report - 2026-08-28

Analysis Summary

• Tools Used: zizmor, poutine, actionlint, runner-guard, syft, grype, yamllint, shellcheck
• Total Findings: 1618 (down from 1665 yesterday, -47 / -2.8%)
• Workflows Scanned: 296 (296 succeeded, 0 failed)
• Workflows Affected: ~40 (across all tools; grype/syft findings are per-container-image rather than per-workflow)

Findings by Tool

Tool	Total	Critical	High	Medium	Low
zizmor (security)	30	0	0 (1 warning)	-	-
poutine (supply chain)	0	0	0	0	0
actionlint (linting)	0	-	-	-	-
runner-guard (taint analysis)	13	0	1	12	0
syft (SBOM inventory)	10 images, 3662 packages	-	-	-	-
grype (container CVEs)	1569	0	273	467	99 (+653 negligible, 77 unknown)
yamllint (yaml linting)	0	-	-	-	-
shellcheck (shell linting)	6	-	-	-	-

Clustered Findings by Tool and Type

Zizmor Security Findings

Issue Type	Severity	Count	Affected Workflows
github_action_from_unverified_creator_used	info	29	28 workflows (all already have # zizmor: ignore[...] suppression comments in place — see details)
pr_runs_on_self_hosted	warning	1	smoke-copilot-arm.lock.yml

Poutine Supply Chain Findings

None — scanner ran clean across all 296 workflows.

Actionlint Linting Issues

None — 0 issues across all 296 workflows (actionlint's own rule engine; its embedded shellcheck/pyflakes integration is what surfaced the shellcheck findings below).

Syft SBOM Inventory

Image	Packages	Notes
ghcr.io/oraios/serena:1.7.0	1678	Largest footprint by far (Python-based MCP tool image)
ghcr.io/github/gh-aw-firewall/agent:0.28.9	531
ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.9	348
ghcr.io/github/gh-aw-mcpg:v0.4.13	288
ghcr.io/github/gh-aw-firewall/api-proxy:0.28.9	193
grafana/mcp-grafana:1.1.0-alpine	178
ghcr.io/github/gh-aw-node	177
node:lts-alpine	165
ghcr.io/github/gh-aw-firewall/squid:0.28.9	63
ghcr.io/github/github-mcp-server:v1.11.0	41

Runner-Guard Taint Analysis Findings

No overall Runner-Guard Score/grade was printed in this run's output.

Rule ID	Name	Severity	Count	Affected Workflows
RGS-012	Secret Exfiltration via Outbound HTTP Request	High	1	github-remote-mcp-auth-test.lock.yml:1700
RGS-005	Excessive Permissions on Untrusted Trigger	Medium	12	agentic_commands.yml, ai-moderator.lock.yml (×5), q.lock.yml (×3), squad.lock.yml (×3)

Issues created: none. RGS-012 on github-remote-mcp-auth-test.lock.yml is already covered by closed issue #55652 (same rule + file — skipped per dedup policy). RGS-005 is Medium severity, which is below the Critical/High threshold for issue creation.

Grype Container Vulnerability Findings

High-severity application-level (GHSA/CVE) findings — fixable via dependency bump

Package	Vulnerability	Installed	Fix	Image(s)
tar	GHSA-r292-9mhp-454m	7.5.19	7.5.21	gh-aw-firewall/agent, api-proxy, cli-proxy, node:lts-alpine
tar (×8 CVEs)	GHSA-34x7-hfp2-rc4v, GHSA-83g3-92jg-28cx, GHSA-8qq5-rm4j-mr97, GHSA-8x88-c5mf-7j5w, GHSA-9ppj-qmqm-q256, GHSA-qffp-2rhf-9h96, GHSA-r292-9mhp-454m, GHSA-r6q2-hw4h-h46w	6.2.1/7.4.3	various 7.5.x	oraios/serena
brace-expansion	GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895	5.0.7 / 2.0.2	5.0.8-9 / 2.1.2-4	agent, api-proxy, cli-proxy, node:lts-alpine, serena
ip-address	GHSA-mwp4-54f8-5fhr	9.0.5/10.2.0	10.3.1	agent, api-proxy, cli-proxy, node:lts-alpine, serena
minimatch	GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj	9.0.5	9.0.6/9.0.7	serena
glob	GHSA-5j98-mcp5-4vw2	10.4.5	10.5.0	serena
picomatch	GHSA-c2c7-rcm5-vvqj	4.0.2	4.0.4	serena
sigstore (py)	GHSA-52v5-jr5w-gjxr	3.1.0	4.1.1	serena
github.com/sigstore/fulcio	GHSA-f5mr-q85p-6hh6	v1.8.5	1.8.6	gh-aw-mcpg
github.com/moby/go-archive	GHSA-hfg8-hc9c-6c3h	v0.2.0	0.3.0	gh-aw-mcpg
google.golang.org/grpc	GHSA-hrxh-6v49-42gf	v1.81.1	1.82.1	gh-aw-mcpg
undici	GHSA-v3r7-h72x-cjcm, GHSA-m8rv-5g2x-5cg5, GHSA-8xcm-r25x-g524	6.27.0	6.28.0	gh-aw-firewall/agent

OS-level High findings dominated by libssl3/libcrypto3 (OpenSSL, fix 3.5.8-r0 on Alpine images), libc6/libc-bin, curl/libcurl*, openssh-*, largely inherited from base images.

Notable change: grype critical findings are now 0 across all 10 images — the last remaining critical (GHSA-23hp-3jrh-7fpw in tar@7.5.16 on node:lts-alpine) is resolved. See Historical Trends below for the image-version-bump breakdown behind the high-severity improvement.

Yamllint YAML Linting Findings

None.

Shellcheck Shell Linting Findings

Code	Count	Affected Workflow (step)
SC2086	6	daily-cli-performance (mcp-scripts.go, mcp-scripts.make), daily-hippo-learn (mcp-scripts.hippo), hippo-embed (mcp-scripts.hippo), smoke-claude (mcp-scripts.go, mcp-scripts.make)

Root cause: .github/workflows/shared/go-make.md and .github/workflows/shared/hippo-memory.md expand $INPUT_ARGS unquoted in their run: blocks. Unchanged since 2026-08-27. See fix suggestion below.

Top Priority Issues

1. RGS-012 — Secret Exfiltration via Outbound HTTP Request (High)

• Tool: runner-guard
• Count: 1
• Severity: High
• Affected: github-remote-mcp-auth-test.lock.yml:1700
• Description: A run: step ("Verify raw GitHub remote MCP handshake") performs an HTTP request pattern that runner-guard's taint model flags as a potential secret-exfiltration vector.
• Impact: If the target host were attacker-influenced, secrets available to the job could be sent off-repo.
• Status: Already tracked and closed as reviewed/accepted in issue [static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in github-remote-mcp-auth-test.lock.yml #55652 (persists across scans; no new issue filed per dedup policy).

2. gh-aw-mcpg image regression (High, grype)

• Tool: grype
• Count: High severity findings rose 18 → 35 after bumping ghcr.io/github/gh-aw-mcpg from v0.4.10 → v0.4.13
• Affected: ghcr.io/github/gh-aw-mcpg:v0.4.13
• Description: New Go module CVEs (sigstore/fulcio, moby/go-archive, google.golang.org/grpc) appeared with the version bump.
• Impact: Worth a follow-up dependency bump inside the mcpg image build to pick up patched versions of these three modules.
• Reference: GHSA-f5mr-q85p-6hh6, GHSA-hfg8-hc9c-6c3h, GHSA-hrxh-6v49-42gf

3. shellcheck SC2086 in mcp-scripts shared tools (Note, but easily fixed)

• Tool: shellcheck
• Count: 6 (across 4 workflows, 2 shared source files)
• Severity: Note
• Affected: daily-cli-performance, daily-hippo-learn, hippo-embed, smoke-claude
• Description: Unquoted $INPUT_ARGS in generated mcp-scripts run: blocks.
• Impact: Low likelihood of exploitation, but a legitimate glob-expansion risk if args ever contains a wildcard pattern that matches files in the runner's working directory.

Fix Suggestion for shellcheck SC2086 (mcp-scripts unquoted args)

Issue: $INPUT_ARGS expanded unquoted in go/make/hippo mcp-scripts tool definitions
Severity: Note
Affected Workflows: 4 workflows (2 root-cause shared files)

Prompt to Copilot Agent:

You are fixing a shellcheck SC2086 finding ("Double quote to prevent globbing and word splitting") in gh-aw's shared mcp-scripts tool definitions.

Files to fix:
- .github/workflows/shared/go-make.md (tools: go, make)
- .github/workflows/shared/hippo-memory.md (tool: hippo)

Each tool's `run:` block currently does: `<cmd> $INPUT_ARGS` unquoted. Do NOT wrap $INPUT_ARGS in double quotes directly — these tools accept multi-word argument strings by design (e.g. args: 'test ./...') and quoting would collapse them into one argument, breaking the tool.

Instead, replace the unquoted expansion with an array split that avoids glob expansion:
  read -ra ARGS <<< "$INPUT_ARGS"
  <cmd> "${ARGS[@]}"

Apply this to the go, make, and hippo tool run blocks. Recompile all workflows afterward so the four affected .lock.yml files (daily-cli-performance, daily-hippo-learn, hippo-embed, smoke-claude) regenerate cleanly, and confirm shellcheck no longer reports SC2086 for these steps.

All Findings Details

Compiler / configuration warnings (non-tool-specific, clustered)

Warning	Count	Notes
sandbox.agent.runtime: cloud-hypervisor privileged KVM preview path notice	101	Informational — requires human security review sign-off per workflow before merge/rollout
workflow_dispatch has no concurrency.job-discriminator	30	ci-doctor, agentic-token-trend-audit, commit-changes-analyzer, copilot-centralization-drilldown, daily-multi-device-docs-tester, dependabot-burner, design-decision-gate, dev, necromancer, notion-issue-summary, pdf-summary, poem-bot, refiner, release, repo-audit-analyzer, repository-quality-improver, research, scout, security-compliance, smoke-codex, smoke-copilot-auto, smoke-workflow-call, smoke-workflow-call-with-inputs, spec-enforcer, squad-implement-worker, squad, technical-doc-writer, uk-ai-operational-resilience, video-analyzer
"ecosystem identifiers instead of domain names" egress hint	11	daily-byok-ollama-test, daily-cli-tools-tester, daily-credit-limit-test, daily-experiment-report, daily-github-docs-seo-optimizer, daily-security-red-team, dependabot-go-checker, docs-noob-tester, refiner, uk-ai-operational-resilience, visual-regression-checker
template separator appears mid-line ({{#if}}/{{/if}})	17	ab-testing-advisor (3), daily-issues-report (4), daily-rendering-scripts-verifier (10)
Prompt references /tmp/ directly (should use /tmp/gh-aw/agent/)	10	archivx-agentic-workflows-analyzer, daily-code-debt-aider, daily-go-test-stubs-aider, daily-multi-device-docs-tester, daily-rendering-scripts-verifier, impeccable-skills-reviewer, jsweep, smoke-copilot-sdk, smoke-copilot-small, super-linter
Missing required permissions for GitHub toolsets (issues/pull-requests read)	8	daily-security-red-team, daily-spending-forecast, front-page-copy-guard, hippo-embed, smoke-claude-on-copilot, smoke-copilot-auto, smoke-github-claude, test-quality-sentinel
sandbox.agent.config.filesystem.allowWrite is ignored for this runtime	3	smoke-claude, smoke-pi, step-name-alignment
experiment comparison uses double quotes (should be single)	2	daily-safe-output-optimizer, smoke-project
checkout: repository auto-derived path:	2	smoke-create-cross-repo-pr, smoke-update-cross-repo-pr
id-token: write permission granted (OIDC risk note)	1	smoke-copilot-aoai-entra
push-to-pull-request-branch: target: "*" with no title/label restriction	1	purelock.md
Both slash_command and bots triggers configured	1	squad.md
Discussion category normalized to lowercase (info)	2	architecture-guardian, commit-changes-analyzer
Workflow redirect configured (info)	1	ai-moderator.md

Engine-related informational notices (experimental engine support / MCP tool allow-listing ignored) appeared for Aider, Crush, Goose, OpenCode, Cursor, DeepSeek Harness, Kiro, and Pydantic AI across ~16+13 occurrences — expected for workflows intentionally using non-default engines.

Zizmor: github_action_from_unverified_creator_used — 28 affected workflows

daily-experiment-report, daily-elixir-credo-snippet-audit, github-mcp-structural-analysis, portfolio-analyst, daily-security-observability, copilot-setup-steps.yml, org-health-report, daily-spending-forecast, daily-code-metrics, prompt-clustering-analysis, daily-news, daily-agentrx-trace-optimizer, python-data-charts, copilot-session-insights, hippo-embed, super-linter, copilot-pr-nlp-analysis, link-check.yml (×2 findings), dataflow-pr-discussion-dataset, detection-analysis-report, audit-workflows, daily-repo-chronicle, weekly-issue-summary, stale-repo-identifier, daily-issues-report, daily-performance-summary, api-consumption-report, smoke-codex.

All instances already carry # zizmor: ignore[github_action_from_unverified_creator_used] suppression comments — these are informational reminders, not unaddressed risk. Actions involved: astral-sh/setup-uv (most common), erlef/setup-beam, safedep/pmg, super-linter/super-linter, gaurav-nelson/github-action-markdown-link-check, actions-ecosystem/action-add-labels.

Historical Trends

• Previous Scan: 2026-08-27
• Total Findings Then: 1665
• Total Findings Now: 1618
• Change: -47 (-2.8%)

Date	Total	Grype Critical	Grype High	Shellcheck	Runner-Guard High	Zizmor
2026-08-25	1524	1	193	0	3	29
2026-08-26	1526	1	193	0	1	30
2026-08-27	1665	1	287	6	1	30
2026-08-28	1618	0	273	6	1	30

New Issues

None. All findings this run are either unchanged from 2026-08-27 or improvements.

Resolved Issues

• Grype critical fully resolved (1 → 0): the last remaining critical finding, GHSA-23hp-3jrh-7fpw (tar CVE on node:lts-alpine), is fixed. This is the first scan since tracking began (2026-08-22) with zero critical container findings.
• Grype high dropped 287 → 273 (-14), driven by container image version bumps:
  • gh-aw-firewall/api-proxy 0.28.7 → 0.28.9: High findings 18 → 4
  • gh-aw-firewall/cli-proxy 0.28.7 → 0.28.9: High findings 18 → 4
  • gh-aw-firewall/agent 0.28.7 → 0.28.9: total findings 350 → 318 (High unchanged at 4)
  • Partially offset by gh-aw-mcpg v0.4.10 → v0.4.13 regressing High 18 → 35 (see Top Priority Issue Add workflow: githubnext/agentics/weekly-research #2)
  • github-mcp-server v1.10.1 → v1.11.0: roughly flat

Recommendations

1. Immediate: No Critical/High findings need new action this run — RGS-012 is already tracked ([static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in github-remote-mcp-auth-test.lock.yml #55652), and the grype critical is resolved.
2. Short-term: Bump the gh-aw-mcpg image's Go module dependencies (sigstore/fulcio ≥1.8.6, moby/go-archive ≥0.3.0, grpc ≥1.82.1) to reverse the High-severity regression from the v0.4.13 bump. Apply the SC2086 fix above to the two shared mcp-scripts files.
3. Long-term: Consider bumping oraios/serena past 1.7.0 once a release with updated tar/minimatch/glob/brace-expansion npm dependencies is available — it accounts for the largest share of grype High findings (155) and package footprint (1678 packages) of any scanned image.
4. Prevention: The 30 workflow_dispatch workflows without a concurrency.job-discriminator and the 10 workflows referencing /tmp/ directly are cheap, mechanical fixes worth batching into a cleanup pass.

Next Steps

• Apply the SC2086 fix to shared/go-make.md and shared/hippo-memory.md
• Bump gh-aw-mcpg image dependencies to address the new High-severity Go module CVEs
• Evaluate an oraios/serena version bump to shed its outdated npm dependency tree
• Batch-add concurrency.job-discriminator to the 30 flagged workflow_dispatch workflows
• Route remaining /tmp/-referencing prompts through /tmp/gh-aw/agent/

References:

• §33150116946

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 📊 Static Analysis Report · claude · agent · 231.5 AIC · ⌖ 8.89 AIC · ⊞ 11.9K · ◷

• expires on Sep 3, 2026, 11:36 PM UTC-08:00

[github-actions]

This issue is being closed as outdated. A newer issue has been created: #56830

View newer issue

---

This action was performed automatically by the Static Analysis Report workflow.