[Security] Security issue in your GitHub CI workflow YAML files

[cicd-security]

Hello maintainers,

I would like to report a potential vulnerability in your GitHub CI workflows.

Affected files:

• swcstudio/supercompute/.github/workflows/issue-automation.yml

Vulnerability:

• In job 'ai-task-orchestration', step 'Execute AI task', attacker-controlled input from 'github.event.comment.body' is extracted in step 'Parse AI command' and then unsafely spliced into JavaScript string literals. This allows an authorized user to execute arbitrary code within the github-script context.

Thank you for your time and for maintaining this project.

[github-actions]

🤖 Hi @cicd-security, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

[github-actions]

🤖 Smart Assignment Analysis

Suggested assignees based on expertise:

1. @SomeRandmGuyy

This assignment is based on recent contribution patterns and domain expertise.

[github-actions]

🤖 I'm sorry @cicd-security, but I was unable to process your request. Please see the logs for more details.