pwf-enforcer

This module is mainly a workflow enforcement plugin, but it carries significant security exposure due to execSync-based execution of local shell scripts (inject-plan.sh/check-complete.sh). Critically, the directory containing those scripts can be overridden directly via process.env.PWF_DIR without validation, making the overall risk highly dependent on how trusted that environment variable and the on-disk scripts are. In the absence of attacker influence over PWF_DIR or the scripts directory, the malware/exfiltration likelihood is low; however, the potential for host-level arbitrary command execution is non-trivial and should be treated as a supply-chain/runtime trust boundary issue.