bluesky-feature-pipeline

The YAML appears intended for legitimate ticket-label automation, but it has a significant supply-chain and workflow-security weakness: it executes code from the pull request checkout while exposing a token configured with issues: write permission. The script should be sourced from a trusted immutable base revision or otherwise prevented from being modified by the PR, and actions should preferably be pinned to commit SHAs. The supplied YAML alone does not demonstrate malware, but the execution pattern permits malicious behavior if an untrusted contributor can modify the checked-out script.