merge

This is a local workflow runner, not apparent malware: it parses a supported subset of a GitHub Actions job and executes its shell steps from the selected commit. The main security risk is executing potentially untrusted pull-request workflow commands with the caller's inherited environment and unrestricted local/network access; do not run it on untrusted commits in an environment containing secrets. It writes a local log at `ai-build-kit-local-check.log` under the Git common directory and uses temporary worktree/output paths; no specific credential names, domains, or URLs are targeted in this code. Severity is high when used with untrusted commits or a privileged environment, and otherwise depends on the selected workflow.

This helper searches two filesystem locations and executes the first matching review_boxes.py before passing it body. Dynamic execution from a current-working-directory path is a code-execution risk if that path is attacker-controlled; no evidence of data theft or other malicious behavior is present in the supplied fragment. Severity is conditional on control of the candidate file.