Issue
Credential env vars set from job outputs (e.g. GH_TOKEN: ${{ needs.fetch_token.outputs.token }}) are not excluded from the agent sandbox.
gh aw compile only adds --exclude-env when the value expression contains ${{ secrets.. Job-output tokens skip that check.
Problem / severity
High. The token stays visible inside the AWF container (env / printenv / bash). With tools like bash: [gh], a prompt-injected agent can read and use it.
Migrating from secrets.* PATs to ephemeral job-output tokens silently drops sandbox exclusion. There is no frontmatter way to exclude env vars manually.
Repro
---
on: workflow_dispatch
jobs:
fetch_token:
runs-on: ubuntu-latest
outputs:
token: ${{ steps.t.outputs.token }}
steps:
- id: t
run: echo "token=ghs_dummy" >> "$GITHUB_OUTPUT"
tools:
bash:
- gh
mcp-scripts:
example:
description: "injects GH_TOKEN from a job output"
env:
GH_TOKEN: ${{ needs.fetch_token.outputs.token }}
py: |
print("ok")
---
# noop
Lock file: awf has --env-all but no --exclude-env GH_TOKEN. Observed excludes look like:
--env-all --exclude-env ANTHROPIC_API_KEY --exclude-env GITHUB_MCP_SERVER_TOKEN --exclude-env MCP_GATEWAY_API_KEY
With GH_TOKEN: ${{ secrets.SOME_PAT }}, --exclude-env GH_TOKEN is present.
Expected behavior
Env vars that carry GitHub credentials into the agent job should get --exclude-env, including values from needs.*.outputs.*, not only ${{ secrets.* }}. Or a way should be provided to exclude these variables too. To give control to the user
Issue
Credential env vars set from job outputs (e.g.
GH_TOKEN: ${{ needs.fetch_token.outputs.token }}) are not excluded from the agent sandbox.gh aw compileonly adds--exclude-envwhen the value expression contains${{ secrets.. Job-output tokens skip that check.Problem / severity
High. The token stays visible inside the AWF container (
env/printenv/ bash). With tools likebash: [gh], a prompt-injected agent can read and use it.Migrating from
secrets.*PATs to ephemeral job-output tokens silently drops sandbox exclusion. There is no frontmatter way to exclude env vars manually.Repro
Lock file:
awfhas--env-allbut no--exclude-env GH_TOKEN. Observed excludes look like:With
GH_TOKEN: ${{ secrets.SOME_PAT }},--exclude-env GH_TOKENis present.Expected behavior
Env vars that carry GitHub credentials into the agent job should get
--exclude-env, including values fromneeds.*.outputs.*, not only${{ secrets.* }}. Or a way should be provided to exclude these variables too. To give control to the user