Will It Vibe?workflow_run trigger runs in an elevated context
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 4 points from that category, once per scan, no matter how many places it turns up.
What it detects
The workflow triggers on workflow_run, so it runs in the context of the base repository with a read/write token after another workflow finishes. Consuming artifacts or head refs from the triggering run without validation is a privilege-escalation path. This is a heuristic flag on the trigger.
Why it matters
workflow_run fires after another workflow completes and runs with the base repository token and secrets, in a read/write context. If it downloads artifacts or reads head refs produced by the triggering run without validating them, attacker-influenced data flows into a privileged job. This flag is heuristic; a workflow_run that only reads trusted metadata is fine.
How to fix it
Treat everything from the triggering run as untrusted: validate artifact contents and never execute them, and do not interpolate head_branch or head_sha into shell without checking. Set least-privilege permissions on the workflow_run job. Where possible, prefer the safer alternative of a single workflow with a validated pull_request stage.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo