[uk-ai-resilience] UK AI Governance: untrusted network data written to file in scripts/ensure-docs-slide-pdf.js (Tier C)

### UK AI Governance — Tier C: Untrusted network data written to disk without validation

**Tier**: C — Restricted Pending Review
**Source**: CodeQL alert [#654](https://github.com/github/gh-aw/security/code-scanning/654) (`js/http-to-file-access`, severity: warning)
**File**: `scripts/ensure-docs-slide-pdf.js`

### Risk-scoring breakdown

| Dimension | Score |
|---|---|
| Exposure amplification | Low (docs build script only, not user-facing runtime) |
| Patchability | High (simple content validation fix) |
| Detectability | Low (no runtime alerting/observability today) |
| Operational fragility | Low |
| Ownership confidence | Medium |

### Finding

CodeQL flagged that network response data is written to the file system without further validation in the docs build script, which "allows arbitrary file upload and might indicate a backdoor" per the rule description. This was surfaced as part of the recent-changes-focused UK AI Open Code Risk & Resilience Governance review (7-day lookback).

### Remediation action

Validate/sanitize the network response content before writing to disk in `scripts/ensure-docs-slide-pdf.js` — e.g., verify content-type, enforce a size limit, and/or checksum the expected artifact rather than trusting the raw HTTP response body.

**SLA urgency**: High

### Governance report

Full context, asset graph, and control-verification findings are in the linked governance discussion report (UK AI Open Code Risk & Resilience Governance — 2026-08-18).

> Generated by [UK AI Operational Resilience](https://github.com/github/gh-aw/actions/runs/32155339339) · auto · 51.6 AIC · ⌖ 2.27 AIC · ⊞ 9.3K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fuk-ai-operational-resilience%22&type=issues)