[sighthound] Security findings in github/gh-aw

[github-actions]

Sighthound reported multiple actionable findings. Top 5 highest-severity findings are listed below:

• actions/setup/js/update_release.test.cjs:195 — Critical (Code Injection, CWE-94): tainted params reach eval.
  • Remediation: remove eval; use explicit parsing/dispatch with strict allowlists and input validation.
• actions/setup/js/update_release.test.cjs:222 — Critical (Code Injection, CWE-94): tainted params reach eval.
  • Remediation: same as above; avoid dynamic code execution and refactor to deterministic handlers.
• pkg/workflow/config_helpers.go:198 — Medium (Unsafe Deserialization, CWE-502): yaml.Unmarshal(yamlBytes, target).
  • Remediation: unmarshal into concrete typed structs only, reject unknown fields, and validate schema/constraints post-parse.
• pkg/workflow/known_action_credentials.go:186 — Medium (Unsafe Deserialization, CWE-502): yaml.Unmarshal([]byte(stepsYAML), &steps).
  • Remediation: use strict typed decode path and enforce validation before use.
• pkg/workflow/known_action_credentials.go:176 — Medium (Unsafe Deserialization, CWE-502): yaml.Unmarshal([]byte(stepsYAML), &wrapped).
  • Remediation: same typed+validated decode strategy; constrain accepted YAML structure.

Source: /tmp/gh-aw/agent/sighthound/actionable.json.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

Generated by 🛡️ Sighthound Security Scan · codex · gpt53codex · 5.57 AIC · ⌖ 4.11 AIC · ⊞ 18.7K · ◷

[github-actions]

This issue is being closed as outdated. A newer issue has been created: #63358

View newer issue

---

This action was performed automatically by the Sighthound Security Scan workflow.