<< Back to security report

──z80dev/lemon/agent-games — semgrep Scan

Repositoryz80dev/lemon →

Commita418a19 →

VerdictFAIL

Score25

DateSep 2, 2026

──Findings

Severity	Rule	Message	File:Line
HIGH	yaml.github-actions.security.run-shell-injection.run-shell-injection	Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".	z80dev/lemon/agent-games-17cadd22/.github/workflows/changelog-check.yml:33 →
HIGH	yaml.github-actions.security.run-shell-injection.run-shell-injection	Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".	z80dev/lemon/agent-games-17cadd22/.github/workflows/live-eval.yml:78 →
HIGH	yaml.github-actions.security.run-shell-injection.run-shell-injection	Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".	z80dev/lemon/agent-games-17cadd22/.github/workflows/release.yml:135 →
HIGH	yaml.github-actions.security.run-shell-injection.run-shell-injection	Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".	z80dev/lemon/agent-games-17cadd22/.github/workflows/release.yml:875 →
MEDIUM	python.lang.security.audit.exec-detected.exec-detected	Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.	z80dev/lemon/agent-games-17cadd22/apps/coding_agent/priv/python_repl/runner.py:717 →
MEDIUM	python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.	z80dev/lemon/agent-games-17cadd22/scripts/live_discord_matrix.py:112 →
MEDIUM	python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.	z80dev/lemon/agent-games-17cadd22/scripts/telegram_driver.py:236 →