gh-aw inspection could launch a workflow-declared MCP executable

A workflow import can look like inert configuration while containing instructions for an executable MCP server. In the affected gh-aw flow, an imported workflow defined an stdio server in frontmatter; the add path accepted it, and mcp-inspect could start the declared program. The command started as the tool operator, before a separate model-level authorization of its own effects.

Two independent permissions were involved. Importing a workflow was not approval to start all programs described inside it, and inspecting the imported metadata was not necessarily a safe read operation. The reported scanner did not examine the frontmatter as executable content, while the paths that required explicit authorization differed from the vulnerable add-and-inspect combination. A controlled demonstration showed the execution boundary crossing, but did not establish a criminal deployment or production victim.

GitHub Security Lab's advisory describes the 0.91.12 fix. The useful regression test is not a search for malicious words in Markdown. It is a benign test executable in workflow frontmatter, invoked through every affected MCP route, confirming that import, inspection and process startup each enforce the operator's trust decision.