gh-work-report

This workflow generates and deploys GitHub activity reports. It does not show clear malware behavior or unrelated exfiltration, but it can disclose private repository names, descriptions, and pull-request activity because private repositories are not filtered before publication; severity depends on whether GitHub Pages is publicly accessible. It also includes unescaped repository titles and descriptions in generated Markdown. Confidence is high that the data flow exists, but public exposure depends on Pages configuration.