grill-test

This module implements workflow validation, test execution, and stage-scoped write checks; it contains no direct evidence of malware, credential theft, or network exfiltration. The primary security risk is that caller-controlled arguments to allowed test executables can run arbitrary code in the project context, with access to files and non-filtered environment variables. Lexical path checks may also be bypassed through symlinks. Severity is moderate and depends on who can supply workflow inputs and create project symlinks.