A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
The workflow uses a GitHub release action that has been archived by its maintainer. It still works but will no longer receive security patches or bug fixes. This is a maintenance hygiene issue for the project's release pipeline, not a demonstrated security threat.
Technical evidence
Scanner reason: zizmor matched workflow-security rule archived-uses. The match applies to this repository.
Contextual assessment: The workflow at file uses actions/create-release@v1 on line 70 to create GitHub releases. Zizmor flagged this because the actions/create-release repository is archived and no longer maintained. This is a CI/CD tooling file with execution scope limited to GitHub Actions automation; it is not part of the shipped extension. The action receives only GITHUB_TOKEN and statically defined parameters (tag name, release name, body from prior step outputs). No untrusted or attacker-controlled input flows into executable or injection-prone parameters of this action. The archived status means no future security fixes, but no current vulnerability or malicious behavior is demonstrated. This is a minor CI hygiene weakness.
Impact: low · Exploitability: unlikely
Developer action: Replace actions/create-release@v1 with the actively maintained gh CLI release creation command (gh release create) or another supported release action.
The workflow writes the GitHub token to a file on disk. While the runner is ephemeral and the token is short-lived, writing secrets to files is poor hygiene and unnecessary since the environment variable is already available.
Technical assessment
Line 27 writes ${{ secrets.GITHUB_TOKEN }} to a file named gh_token, and the same step also sets GH_TOKEN via env. Writing the token to the runner filesystem is unnecessary since GH_TOKEN is already available to the gh CLI through the environment. The runner is ephemeral and the token is scoped and short-lived, so concrete harm is not demonstrated, but this is a minor hygiene weakness.
Impact: low · Exploitability: unlikely
Developer action: Avoid writing the token to the filesystem; use the GH_TOKEN environment variable already set in the same step, and remove the gh_token file or ensure cleanup.