show-run-status

This Bash script gathers project status and optionally runs the configured unit-test command. Its main security risk is executing the command from docs/agents/project.md through eval, allowing a modified or untrusted documentation file to run arbitrary shell commands as the invoking user; the code argument also permits path and regex manipulation. GitHub CLI operations query authenticated issue and pull-request data, but no direct data exfiltration or destructive behavior is present in the script itself. Overall severity is moderate and depends on the trustworthiness of the repository files and test command.