obsidian-plugin-release

No clear evidence of intentional malware (no exfiltration, credential theft, or payload execution). However, the script uses `spawnSync('sh', ['-c', cmd])` and interpolates non-validated values (notably the git branch name and gh runId) into shell commands. This creates a potential command-injection risk if those values can contain shell metacharacters, which could lead to unintended command execution during the release process. Security risk is therefore primarily about command injection rather than direct malicious payloads.