[sighthound] Security findings in github/gh-aw

[github-actions]

Sighthound scanned github/gh-aw and found 154 total findings, 121 actionable (outside test/testdata). Top 5 by severity below. Note: these exec.Command calls use a fixed argument slice (no shell), so injection risk is likely low/false-positive, but worth a quick review for confidence.

1. pkg/cli/runner_guard.go:117 — Critical, Command Injection (CWE-78)
   exec.Command(dockerPath, dockerArgs...)
   Verify dockerArgs are built only from fixed/validated values, not raw untrusted input; document why this is safe or add validation.

2. pkg/cli/grant.go:176 — Critical, Command Injection (CWE-78)
   exec.Command(dockerPath, "run", "--rm", "-v", volumeMount, GrantImage, "--config", containerPolicyPath, "--output", "json", "check", imageRef)
   Confirm volumeMount, containerPolicyPath, and imageRef are sanitized/validated before being passed as args.

3. pkg/cli/poutine.go:241 — Critical, Command Injection (CWE-78)
   exec.Command(dockerPath, "run", "--rm", "-v", volumeMount, "-w", "/workdir", PoutineImage, "analyze_local", ".", "--format", "json", "--quiet")
   Same pattern as above; validate volumeMount value.

4. pkg/cli/poutine.go:121 — Critical, Command Injection (CWE-78)
   Duplicate of the poutine.go:241 pattern in another code path — apply same validation.

5. pkg/cli/upgrade_command.go:507 — Critical, Command Injection (CWE-78)
   exec.Command(exe, newArgs...)
   Confirm exe and newArgs originate from trusted/internal sources (e.g., resolved binary path) rather than user-controlled input.

Full scan summary: 154 findings total, 121 actionable. See Sighthound scan artifacts for the complete list.

Generated by 🛡️ Sighthound Security Scan · auto · 18.7 AIC · ⌖ 2.01 AIC · ⊞ 7.8K · ◷