easysam-skill

No direct indicators of overt malware (e.g., reverse shells, credential theft, or data exfiltration) are present in this workflow snippet. However, it contains meaningful supply-chain and trust-boundary risks: it executes a network-downloaded installer via `curl | sh`, it references GitHub Actions only by major version, and it runs a custom CLI (`easysam`) for generate/deploy with AWS privileges on every push. These factors warrant hardening (pin installer/actions by checksum/commit, enforce dependency lockfile integrity, and consider gated deployments/least-privilege roles).