[Security] Security issue in your GitHub CI workflow YAML files

[cicd-security]

Hello maintainers,

I would like to report a potential vulnerability in your GitHub CI workflows.

Affected files:

• swcstudio/supercompute/.github/workflows/ai-issue-decomposer.yml

Vulnerability:

• In job 'decompose-issue', step 'Create Subtask Issues', the LLM-generated subtask.title is interpolated into a shell command inside a Node.js script and executed via execSync. The upstream LLM step 'AI Decomposition' is influenced by the attacker-controlled github.event.issue.title and github.event.issue.body, creating a model-mediated command injection sink.
• In job 'decompose-issue', step 'Generate Visualizations', the LLM-generated file dependencies.mmd is processed by the mmdc command-line tool. The upstream LLM step 'AI Decomposition' is influenced by the attacker-controlled github.event.issue.title and github.event.issue.body, creating a potential model-mediated execution sink via vulnerabilities in the mmdc tool.

Thank you for your time and for maintaining this project.

[github-actions]

🤖 Hi @cicd-security, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

[github-actions]

🤖 Smart Assignment Analysis

Suggested assignees based on expertise:

1. @SomeRandmGuyy

This assignment is based on recent contribution patterns and domain expertise.

[github-actions]

🤖 I'm sorry @cicd-security, but I was unable to process your request. Please see the logs for more details.