product-demo

This workflow template executes checked-out pull-request code and package scripts; same-repository pull requests may access configured object-store secrets and the GitHub token, while fork secrets are withheld. Demo IDs are interpolated into shell command text, creating a command-injection risk if IDs are pull-request-controlled. Publishing and cleanup can modify or delete object-store content, whose implementation is not provided. Severity is high if untrusted contributors can submit same-repository pull requests or control IDs; no explicit malware or obfuscated payload is shown.