setup-github

SUSPICIOUS: The GitHub/project/workflow capabilities match the stated purpose, and official Claude/GitHub endpoints are consistent. The main risk is the transitive installation path: `npx skills add` fetches remote skill content from a third-party GitHub repository, which expands trust to unreviewed instructions. No direct credential theft or exfiltration is shown here, but the install/provenance model makes this a medium-high security risk.

The workflow is a conventional ECS deployment pipeline and contains no direct evidence of malware or intentional data theft. It does present moderate supply-chain and credential-management risk because actions are not pinned to immutable commits, long-lived AWS credentials are used, and repository changes can trigger production deployment. The empty TODO configuration values will likely prevent successful deployment until configured.

This is a legitimate automated issue-triage workflow, not apparent malware. Its primary risks are prompt injection through issue content, excessive OIDC permission, exposure of an OAuth credential to a mutable third-party action, and use of an unpinned action reference. Pin the action to a reviewed commit, remove `id-token: write` unless required, and treat issue content and repository instructions as untrusted agent input.

The workflow appears intended for automated PRD collaboration and contains no clear malicious payload or direct data-exfiltration behavior. It has moderate security risk because untrusted issue content and repository instructions influence an authenticated agent with issue-write capability, while the external action is mutable and unnecessary OIDC write permission is granted. Restrict invocation to authorized users, minimize permissions, remove id-token: write unless required, constrain comment and label operations, and pin the action to an immutable reviewed commit.

The workflow implements a legitimate automated PR-review process and contains no direct malware or explicit data-exfiltration code. It has elevated supply-chain and prompt-injection risk because untrusted PR content is processed by a third-party AI action that holds an API secret and write permissions. Pin the action to an immutable reviewed SHA, remove unnecessary id-token: write and issues: write permissions, and isolate or constrain reviews of fork-originated PRs.