fabric

SUSPICIOUS. The skill’s capabilities mostly match its stated Fabric-helper purpose, and there is no clear credential harvesting, hidden exfiltration endpoint, or malicious pre-execution behavior. However, it normalizes runtime `git clone`/`git pull` from a mutable branch and immediate autonomous execution of an external CLI on remote content, which is more trust than necessary and leaves medium supply-chain risk.

This workflow tests and releases Go code, with release publishing limited to the `danielmiessler` repository owner. The main security concern is unquoted interpolation of `github.event.client_payload.tag` into a shell command, which could enable command injection if an attacker can trigger a `tag_created` dispatch with a crafted payload; the workflow also uses actions referenced by mutable version tags. No explicit malware behavior or suspicious domain is evident. Overall severity is moderate and depends on who can dispatch the event.