GitHub Agentic Workflows compilation status used a predictable symlinkable temp path

The GitHub Agentic Workflows MCP compiler wrote progress status using a predictable .tmp path. Local filesystem entries could redirect the write through a symbolic link or retain permissive file modes.

GHSA-796w-fvw2-ccmp documents the possible overwrite and status disclosure under the compiler process permissions; it is a local preplant condition rather than an unauthenticated remote exploit.

The compiler's progress report is written to a predictable temporary name. If an attacker who already has access to the shared local directory pre-creates a symlink or permissive file, an ordinary write may follow that link or retain the existing mode despite the code requesting 0600. A later rename can preserve the compromised content or exposure. The file-write effect remains bounded by the permissions of the process running the compiler; the advisory does not describe an unauthenticated network entry point. The appropriate primitive is exclusive creation of a fresh file in an owned directory, no-follow behavior and atomic replacement, followed by verification of the final mode and destination.

The attack depends on a local actor planting or controlling the predictable temporary name before a privileged compiler writes its progress file. An existing file or symlink can preserve unsafe permissions or redirect the write, despite a caller requesting a secure mode. This is a local filesystem trust boundary in the compilation workflow, not evidence of remote exploitation of hosted GitHub Actions. The distinct Copilot token-routing flaw concerns outbound credential audience, so fixing the temporary-file writer does not close that provider-boundary error.