agentic-actions-auditor

This fragment describes a plausible stealthy GitHub Actions workflow risk: attacker-controlled GitHub event content is assigned into env vars via ${{ github.event.* }} and then referenced by name inside an AI action prompt, causing the AI runtime to ingest untrusted data without obvious ${{ ... }} usage in the prompt field. While the fragment itself is not malicious code, affected workflows using AI tooling that evaluates/reads env vars based on prompt instructions are at elevated risk of prompt injection and any downstream actions the AI can perform.