<< Back to security report
Repositoryz80dev/lemon →
Commita418a19 →
VerdictFAIL
Score25
DateSep 2, 2026
| Severity | Rule | Message | File:Line |
|---|---|---|---|
| HIGH | yaml.github-actions.security.run-shell-injection.run-shell-injection | Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". | z80dev/lemon/agent-games-17cadd22/.github/workflows/changelog-check.yml:33 → |
| HIGH | yaml.github-actions.security.run-shell-injection.run-shell-injection | Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". | z80dev/lemon/agent-games-17cadd22/.github/workflows/live-eval.yml:78 → |
| HIGH | yaml.github-actions.security.run-shell-injection.run-shell-injection | Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". | z80dev/lemon/agent-games-17cadd22/.github/workflows/release.yml:135 → |
| HIGH | yaml.github-actions.security.run-shell-injection.run-shell-injection | Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". | z80dev/lemon/agent-games-17cadd22/.github/workflows/release.yml:875 → |
| MEDIUM | python.lang.security.audit.exec-detected.exec-detected | Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. | z80dev/lemon/agent-games-17cadd22/apps/coding_agent/priv/python_repl/runner.py:717 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | z80dev/lemon/agent-games-17cadd22/scripts/live_discord_matrix.py:112 → |
| MEDIUM | python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. | z80dev/lemon/agent-games-17cadd22/scripts/telegram_driver.py:236 → |