aws-iam-trust-audit — who may actually assume your IAM roles

Least-privilege tooling reads permission policies: what a role can do once you are it. The trust policy decides who gets to be it, and it is the half written once during an integration and never reviewed. aws-iam-trust-audit reads trust policies offline and names what is too open: wildcard principals, cross-account AssumeRole without an ExternalId, GitHub OIDC roles whose sub claim matches any repo or branch.