Zuke-build Zuke vulnerabilities
- zuke-build zuke zuke setup and zuke import follow symbolic links planted at scaffold names, allowing writes outside the target directory 5.5 Medium
- zuke-build zuke Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow run 7.5 High
- zuke-build zuke Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gate 7.1 High
- zuke-build zuke Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command line 7.0 High
- zuke-build zuke Zuke: Command-form registry descriptors bypass the MCP launch policy 8.0 High