mastra-smoke-test

The script has a significant command-injection flaw in the unquoted heredoc. Attacker-controlled command-line values, or suitably crafted GitHub-derived values, can execute shell commands during report generation. Quote or escape interpolated values, or generate the document using a method that treats them strictly as data.