gh-aw MCP arguments reinterpreted as privileged command flags

GitHub's Agentic Workflows tooling exposed MCP operations to agent clients, but some supplied strings subsequently passed through a Cobra command-line parser as options. Without a reliable -- boundary and explicit argument handling, text that looked like a workflow name or option value could be interpreted as a privileged switch. The researcher documented access to command modes capable of weakening scans, changing approval behavior or operating on another repository.

This is not evidence that every model spontaneously bypassed GitHub approval. The caller needed access to the gh-aw MCP server, and the effective command and repository permissions constrained the eventual effect. The failure is more precise: the tool's JSON description did not define the full authority of the downstream command parser. An apparently valid invocation could acquire semantics that were never represented in the original tool contract.

The correction in 0.91.12 addressed argument separation and the implicated MCP command paths. Verification needs to exercise each named action on a pinned old and updated version, including paths that are syntactically valid but carry flag prefixes. A language-model refusal is not a substitute for an executor rejecting an unauthorized option.