github-actions[bot]
published Aug 1, 2026, 8:20 AM · updated Aug 1, 2026, 8:20 AM
Daily Runtime Threat Scan
Runtime threat scan complete. Focus area: setup-cli/. Inspected action.yml, install.sh, install.ps1. Both LLM judges returned "clean" — all code exhibits standard installer behavior: binary downloads exclusively from github.com/github/gh-aw/releases with SHA256 checksum verification, GH_TOKEN used only for GitHub API auth, no obfuscation/exfiltration/persistence. State updated: next scan will cover setup/.
Generated from Daily Runtime Threat Scan · 50.1 AIC · ⊞ 7.3K · ◷