[uk-ai-resilience] [security] Review repositories:["*"] default scope in gh aw add-wizard PAT onboarding (Tier B, High)

[github-actions]

Finding

Tier B — Open With Conditions | SLA: High (remediate within 2 weeks)

PR #45987 merged 2026-07-16 added preconfigured Copilot PAT onboarding in gh aw add-wizard. The feature mints a PAT with repositories: ["*"] scope — granting access to all repositories the token owner can access.

Risk Scoring

Dimension	Score (1–5)	Rationale
Exposure amplification	4	AI agents using this token can read/write all repos; blast radius is org-wide
Patchability	4	Scope restriction is a config change
Detectability	3	Token scope is visible in GitHub UI but not surfaced in workflow audits
Operational fragility	3	Overly broad token means one compromised agent session = org-wide exposure
Ownership confidence	4	pelikhan is clear owner

Threat Hypothesis

An attacker who gains control of a Copilot agentic session (e.g., via XPIA/prompt injection in cached content — see #45777) and has access to a token minted with repositories: ["*"] can exfiltrate or modify code across all organisation repositories — far beyond the intended single-workflow scope.

Remediation Actions

1. Audit the current default token scope set by gh aw add-wizard after Add preconfigured Copilot PAT onboarding in gh aw add-wizard #45987.
2. If the default is repositories: ["*"], change it to repositories: [current-repo] or prompt the user to explicitly opt-in to wildcard scope.
3. Add a prominent warning in the wizard UI when wildcard scope is selected.
4. Document least-privilege token guidance in the onboarding flow.

Exception Governance

• Exploit acceleration claim: Combined with XPIA surface ([uk-ai-resilience] [security] Memory/cache XPIA poisoning — consolidate and remediate (#28830, #28775, Tier C Critical) #45777), wildcard scope turns a prompt injection into a multi-repo exfiltration primitive.
• Expiry date: 2026-07-30 (must be reviewed before next release)
• Mitigation plan: Scope narrowing in add-wizard command; wizard warning text.

Related

• PR Add preconfigured Copilot PAT onboarding in gh aw add-wizard #45987 (introduced surface)
• Issue [uk-ai-resilience] [security] Memory/cache XPIA poisoning — consolidate and remediate (#28830, #28775, Tier C Critical) #45777 (XPIA consolidation — complementary risk)
• uk-ai-resilience report — 2026-07-16

Run: §29513136890

Generated by UK AI Operational Resilience · 74.6 AIC · ⌖ 5.37 AIC · ⊞ 5.1K · ◷