Forwarding is not the default behavior, so normally you're fine.

For others, if you do this:

    Host *
      ForwardAgent yes

you can take this as a reminder that `Host *` is playing with fire, and just asking for accidents like this. Be extremely careful with `Host *` configs, especially with anything security-sensitive.

"Careful", as in "do not do it if there's literally any risk". And if you don't know for sure, consider it a risk by default. `Host *.internal` at a minimum, or whatever hostname / dns patterns are used around you, is dramatically safer and just as convenient.

Alternatively you can config id_rsa from different path specifically for github and your work repo.

Use a general non-identifiable id_rsa to play with public ssh servers.

If you're going to change your config, couldn't you just... not have forwarding?