Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | ||
| fetch-depth: 2 | ||
|
|
||
| - uses: Portkey-Wallet/claude-code-security-review@main |
There was a problem hiding this comment.
🤖 Security Issue: GitHub Action uses unversioned third-party action 'Portkey-Wallet/claude-code-security-review@main' with API key access
Severity: HIGH
Category: third_party_dependency_risk
Tool: ClaudeCode AI Security Analysis
Exploit Scenario: The action references '@main' branch which can be modified at any time by the repository owner. If the Portkey-Wallet repository is compromised or the owner becomes malicious, they could modify the action to exfiltrate the CLAUDE_API_KEY secret or inject malicious code into the CI/CD pipeline. The action has write permissions to pull requests and read access to repository contents.
Recommendation: Pin the action to a specific commit SHA or release version instead of using '@main'. Example: 'Portkey-Wallet/claude-code-security-review@abc1234' or verify and fork the action to your own organization for better control.
1 participant
No description provided.