[uk ai resilience] UK AI Open Code Risk & Resilience — Weekly Assessment (2026-08-13)

[github-actions[bot]]

Aligned to: [UK Gov guidance — AI, open code and vulnerability risk in the public sector]((www.gov.uk/redacted) Scope: recent-changes focus, 7-day lookback (since 2026-08-06).

1. Executive Summary

• 305 commits landed in the lookback window; 79 (26%) were flagged as security-signal commits (validation/sanitization/token/auth-related). Author mix is AI-agent-heavy: 237 commits by "Copilot", 44 by github-actions[bot], 10 by a human maintainer (Peli de Halleux), 9 by dependabot. This confirms the repo is a live case study for AI-assisted open-source development risk.
• 32 open "security-signal" issues, 5 open code-scanning alerts, 0 open secret-scanning alerts.
• Net assessment: no evidence of concealment-worthy or actively exploited issues. The two categories needing attention are (a) an already-tracked container CVE backlog, and (b) an already-tracked GraphQL query-construction hardening item. Two other code-scanning alerts are noise/stale (test dummy, historical binary artifact) and one (js/http-to-file-access) is already mitigated with explicit validation and an lgtm suppression.
• Governance loop is operating: static-analysis, sighthound, and container-scan findings are already being triaged into tracked issues ([uk-ai-resilience] Prioritize burn-down of container CVE backlog (67 Critical / 438 High across 10 scanned images) #52322, [uk-ai-resilience] Remediate GraphQL injection code-scanning alerts in pkg/cli/project_command.go (#651/#652) #52321) rather than sitting unmanaged — this is a resilience strength, not a gap.

2. Asset Graph Summary (recent-change scoped)

Segment	Recent activity	Runtime area
pkg/cli/project_command.go	GraphQL query construction via fmt.Sprintf w/ escapeGraphQLString	GitHub Projects v2 CLI integration
pkg/workflow/pip_validation.go	PEP 508 package-name validation added ahead of exec.Command	Python/uv sandbox tooling
pkg/workflow/dependabot.go	npm install command construction	Dependency automation
pkg/cli/grype.go	docker run wrapper for image scanning	Supply-chain scanning tool integration
pkg/intent/policy.go	PolicyCompiler seeding-rule validation gap	Advisory-only policy engine (not yet wired to enforcement)
scripts/ensure-docs-slide-pdf.js	PDF download+validation before write	Docs build pipeline
Container images (10 scanned)	gh-aw-mcpg, gh-aw-firewall/*, gh-aw-node, grafana/mcp-grafana, github-mcp-server, node:lts-alpine	Sandbox/firewall runtime supply chain
.github/workflows/*	285 workflows scanned; zizmor/runner-guard/actionlint/poutine/yamllint/shellcheck	CI/CD and agentic workflow definitions

Ownership signal: heavy AI-authorship with human maintainer review concentrated in a small set of committers (pelikhan, Landon Cox, Don Syme) — acceptable for an OSS project with active human oversight of merges, but ownership coverage should be tracked as a metric (see §8).

3. Tier Classification Table

Area	Tier	Rationale
pkg/workflow/pip_validation.go (exec.Command + pkgName)	A — Open Safe	PEP 508 allow-list validation (validatePipPackageName) already applied before every exec.Command call site (lines 71, 168, 225); Sighthound finding is a false positive given current code.
scripts/ensure-docs-slide-pdf.js (alert #654, js/http-to-file-access)	A — Open Safe	validatePdfBytes/validateSlideDeckResponse gate content-type, size, and magic-bytes before write; explicit lgtm suppression present. No action needed beyond periodic re-verification.
Code-scanning alert #564 (workflow-security-finding-1, README.md)	A — Open Safe	Confirmed smoke-test dummy finding, not a real vulnerability.
Code-scanning alert #653 (workflow-out-of-context, committed actionlint/gosec binaries)	B — Open With Conditions	Threat Score 4/10, assessed as accidental (build artifacts committed in PR #48979, hashes match known upstream releases), but ~78MB of opaque binary in git history bypasses code review norms for a source-only Go repo. Condition: remove binaries, add to .gitignore, confirm go install is the CI path.
pkg/cli/project_command.go GraphQL query construction (alerts #651/#652)	B — Open With Conditions	escapeGraphQLString currently mitigates but is a manual-escaping pattern flagged as brittle; already tracked in issue #52321. Condition: migrate to GraphQL variables.
pkg/intent/policy.go seeding-rule validation gap (#52516)	B — Open With Conditions	Currently advisory-only / not wired to runtime enforcement, so blast radius is low today, but must be fixed before Authorizer.AuthorizeTool integration ships to avoid a fail-open condition.
Container image CVE backlog (10 images, 67 Critical/441 High)	C — Restricted Pending Review	Already tracked in issue #52322; volume and severity justify continued restricted status (i.e., no expansion of image usage) until backlog is burned down.
pkg/workflow/dependabot.go / pkg/cli/grype.go exec.Command wrappers	A — Open Safe	Sighthound flagged context construction, not unvalidated direct injection; both wrap fixed subcommands with structured arguments (GrypeImage constant, working-directory scoped npm), consistent with the pattern already hardened in pip_validation.go. Recommend a follow-up confirmation pass, not urgent remediation.

4. Control Verification Gaps

Control Domain	Status	Note
Ownership (CODEOWNERS)	Present	CODEOWNERS file exists at repo root; recommend confirming explicit path rules cover pkg/cli/, pkg/workflow/, pkg/intent/ directly rather than relying on default/global owners.
SDLC (CI, review, tests)	Present	Deterministic tests referenced in recent commit history (e.g., "Fix uv @version stripping ... deterministic test"); PR-based workflow evident from commit messages.
Dependency controls	Partial	Dependabot active (9 commits in window) and container scanning runs regularly, but CVE backlog (67 Critical/441 High) shows patch velocity lagging discovery velocity.
Secret exposure	Present	0 open secret-scanning alerts; OAuth token check step already made conditional in recent commits ("Skip entire OAuth token check step when no secrets need checking").
Runtime observability	Present	pkg/logger namespace-based debug logging actively expanded this window ("Add debug logging to guard-policy, arc-dind, and validation helpers", "... threat-detection, frontmatter, and validation paths").
Recovery (patch/rollback)	Partial	No evidence of documented rollback runbook for the sandbox/firewall image supply chain; recommend documenting rollback/pinning strategy for the 10 scanned images given the active CVE backlog.

5. Risk-Scoring Table & Rationale

Area	Exposure Amplification	Patchability	Detectability	Operational Fragility	Ownership Confidence	Tier
GraphQL injection (project_command.go)	Low (escaped, advisory context)	High (swap to variables, small diff)	High (CodeQL already caught it)	Low	High (tracked, #52321)	B
Policy seeding-rule validation gap	Low today (advisory-only)	High (add same rank-check to seed path)	Medium (found via deep-report, not CI-gated)	Medium (grows if wired to enforcement without fix)	Medium	B
Committed binaries (actionlint/gosec)	Low (no malicious intent found)	High (delete + gitignore)	High (flagged by scanner)	Low	Medium	B
Container CVE backlog (10 images)	Medium-High (sandbox/firewall runtime surface)	Medium (requires image rebuild/coordination across 10 images)	High (grype run regularly)	Medium	Medium (tracked, #52322)	C
pip/uv exec.Command pkgName	Low (already validated)	High	High	Low	High	A
PDF download-to-file (docs script)	Low (validated before write)	High	High	Low	High	A

6. Remediation Queue with SLAs

Priority	Item	Action	SLA
High	GraphQL injection hardening (#651/#652, tracked in #52321)	Replace fmt.Sprintf-built queries in project_command.go with GraphQL variables	High (continue existing tracked work)
High	Policy seeding-rule validation (#52516)	Apply autonomyRank/writeScopeRank validation to the first-matching-rule seed path in policy.go, fail closed on unmapped values, before wiring to Authorizer.AuthorizeTool	High — must land before enforcement integration
Medium	Committed binaries out-of-context (#653)	Remove actionlint/gosec binaries from git tree, add to .gitignore, confirm CI uses go install	Medium
Critical (existing)	Container CVE backlog (67 Critical/441 High, tracked in #52322)	Continue burn-down per existing issue; add explicit rollback/pinning runbook for the 10 images	Critical (existing SLA maintained)
Low	Confirm dependabot.go / grype.go exec.Command argument construction	Add code comment documenting why these are safe (mirroring pip_validation.go pattern) to close out Sighthound false-positive noise	Low

7. Exception Register

No new exceptions required this cycle. No repository-hiding or concealment measures recommended — all identified items have clear, auditable remediation paths and existing tracking issues.

8. Operational Metrics Baseline

Metric	Value	Note
MTTR proxy	N/A this cycle	No newly-detected critical issues requiring time-to-remediate measurement; existing issues (#52322, #52321) already in progress
Ownership coverage	~Human review on 10/305 commits (3.3%) directly authored by named humans; remainder AI-agent-authored with bot/CI co-authorship	Recommend tracking human-reviewed-merge percentage explicitly as a KPI
Unsupported/CVE dependency ratio	67 Critical + 441 High across 10 images = high density	Tracked in #52322; primary resilience risk this cycle
Exception aging	0 active exceptions	N/A
Exposure without recovery capability	Container image supply chain lacks a documented rollback runbook	Recommend adding one as part of #52322 remediation

---

Generated by the UK AI Open Code Risk & Resilience governance workflow (recent-changes focus, resilience-over-secrecy strategy). No repository hiding recommended.

Generated by UK AI Operational Resilience · auto · 59.8 AIC · ⌖ 2.75 AIC · ⊞ 8.7K · ◷

• expires on Aug 16, 2026, 7:49 AM UTC-08:00