Daily action/setup/* Security Audit

Durable reports produced by .github/workflows/daily-action-setup-security-audit.md in github/gh-aw.

standalone

.github/workflows/daily-action-setup-security-audit.md

View authored workflow

Reports

0 Open 2 Resolved

Daily action/setup/* Security Audit completed with no action

Daily action/setup/ Security Audit Security audit of actions/setup/ completed. Aspects examined this run: file-permissions and command-injection (reuse), network-requests and supply-chain (new). Scanned 180 non-test source files (js/.cjs and sh/.sh) plus package.json/package-lock.json. Findings: supply-chain: lockfile has 322 packages, all pinned; only 1 without integrity is @actions/github-script pinned to a git commit SHA (acceptable); deps are devDependencies only. No issue. network-requests: runtimeimport.cjs fetch uses redirect:"manual" + timeouts; models/API URLs host-validated. No SSRF/TLS gaps found. command-injection: all eval() usages are confined to test.sh harness files, not s...

complete live noop

Daily action/setup/* Security Audit completed with no action

Daily action/setup/ Security Audit Daily setup/ security audit complete — no new actionable findings. Cycle reset: all 8 aspects were completed in the prior cycle, so a new cycle began. This run covered 4 aspects (2 reuse + 2 new focus): file-permissions (reuse): The single prior known finding (gateway API key wrapper scripts in mountmcpascli.cjs written world-readable at 0o755) is now REMEDIATED — scripts are written via openSync/fchmodSync at 0o700 with explanatory comments; the 0o644 tools-cache file contains only tool metadata, no secrets. command-injection (reuse): All childprocess calls use argument arrays (exec.exec("git", [...])) or static strings. The only string-interpolated exe...

complete live noop