Summary

Compiling a workflow with gh-aw v0.83.4 emits a runtime ${{ }} expression for sink-visibility inside the MCP gateway config run: heredoc. With zizmor persona: auditor, that is flagged as template injection.

Repro

1. Compile a workflow that uses GitHub MCP + safe-outputs (e.g. githubnext/agentics/workflows/issue-triage.md).
2. In the generated *.lock.yml, the “Start MCP Gateway” step contains:

"guard-policies": {
  "write-sink": {
    "accept": ["*"],
    "sink-visibility": ${{ toJSON(steps.determine-automatic-lockdown.outputs.visibility) }}
  }
}

3. Run zizmor --persona=auditor (or equivalent CI). Finding:

template-injection: code injection via template expansion
may expand into attacker-controllable code

Environment

• gh-aw: v0.83.4
• zizmor: 1.26.1 (persona: auditor)
• Workflow: agentics issue-triage (compiled lockfile)