datocms-setup

The workflow contains a high-impact command-injection risk. The manually supplied `profiles` input is expanded unquoted in a shell script, allowing arbitrary commands to run on the GitHub-hosted runner and potentially access the DatoCMS API token. Quote and validate the input, preferably pass it through an environment variable and construct arguments safely without shell evaluation. Restrict workflow triggering permissions and review npm lifecycle scripts and lockfile provenance.

This is a legitimate-looking wrapper for importing Contentful content through the DatoCMS CLI, not evident malware. However, it has security weaknesses: secrets are exposed in command-line arguments and failure messages, and shell execution with forwarded arguments may permit command injection on Windows depending on argument handling and input validation. The CLI should be invoked without a shell where possible, secrets should not be included in errors or command lines, and the executable/package should be pinned or resolved from a trusted local dependency.