[rickeylev]

GitHub Actions workflows and scripts can introduce command, flag, and
environment injection vulnerabilities when handling untrusted inputs
from pull requests, comments, and git refs. Without explicit review
criteria, code review audits may overlook these attack vectors.

Add security review rules and audit checks covering expression
interpolation in run: and script: blocks, untrusted git ref names,
CLI option-flag injection, pre-mutation actor authorization,
single-line $GITHUB_OUTPUT and $GITHUB_ENV writes, and untrusted
stdout suppression.

[rickeylev]

AI Disclosure

• Oversight: semi-autonomous — This PR was authored by an AI coding assistant under human direction and review.
• Comment Handling: Review comments on this PR are monitored and reviewed by the human author, who may use an AI assistant to draft responses or fixes before approving and posting them.

This is an automatically generated agent comment.