postiz

This module implements standard OAuth2 device-flow login/logout/status and stores tokens locally with restrictive permissions, with no clear malware behaviors such as persistence, data corruption, or covert exfiltration. However, it contains a meaningful client-side security risk: openBrowser() uses child_process.exec with a shell command string that directly interpolates a URL derived from a remote auth-server response (verification_uri), creating potential OS command injection. Additionally, authServer/apiUrl are configurable without allowlisting, increasing risk if misconfigured or attacker-influenced.

This workflow is intended to synchronize SKILL.md and commit the result to main. No credential theft, data exfiltration, persistence, destructive behavior, or inherently malicious payload is present. The main security issue is unsafe interpolation of github.event.release.tag_name into a shell command, which may permit command injection if a release tag containing shell metacharacters can be created. Pinning checkout to a commit SHA and safely passing or validating the tag would reduce supply-chain and injection risk.