scaffold-github-cloud-agent-environment

This utility renders a workflow from a plan and writes it to disk or stdout. The plan-controlled `workflow_path` is not constrained to the project directory, so malicious or unintended plan data could cause directory creation, backup moves, or writes outside the project; this is a path-handling security risk, not evidence of malware. No network activity, credential access, or other malicious behavior is visible in this fragment.