Skip to content

[aw] Job-output github-token values are not excluded from the agent sandbox (--exclude-env) #46012

Description

@ivancea

Issue

Credential env vars set from job outputs (e.g. GH_TOKEN: ${{ needs.fetch_token.outputs.token }}) are not excluded from the agent sandbox.
gh aw compile only adds --exclude-env when the value expression contains ${{ secrets.. Job-output tokens skip that check.

Problem / severity

High. The token stays visible inside the AWF container (env / printenv / bash). With tools like bash: [gh], a prompt-injected agent can read and use it.
Migrating from secrets.* PATs to ephemeral job-output tokens silently drops sandbox exclusion. There is no frontmatter way to exclude env vars manually.

Repro

---
on: workflow_dispatch
jobs:
  fetch_token:
    runs-on: ubuntu-latest
    outputs:
      token: ${{ steps.t.outputs.token }}
    steps:
      - id: t
        run: echo "token=ghs_dummy" >> "$GITHUB_OUTPUT"
tools:
  bash:
    - gh
mcp-scripts:
  example:
    description: "injects GH_TOKEN from a job output"
    env:
      GH_TOKEN: ${{ needs.fetch_token.outputs.token }}
    py: |
      print("ok")
---
# noop
gh aw compile <workflow>

Lock file: awf has --env-all but no --exclude-env GH_TOKEN. Observed excludes look like:

--env-all --exclude-env ANTHROPIC_API_KEY --exclude-env GITHUB_MCP_SERVER_TOKEN --exclude-env MCP_GATEWAY_API_KEY

With GH_TOKEN: ${{ secrets.SOME_PAT }}, --exclude-env GH_TOKEN is present.

Expected behavior

Env vars that carry GitHub credentials into the agent job should get --exclude-env, including values from needs.*.outputs.*, not only ${{ secrets.* }}. Or a way should be provided to exclude these variables too. To give control to the user

Metadata

Metadata

Labels

Type

No type

Fields

No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions