TavernKeeper Scan Report

M4Marvin/charon

Commit 0efd69e Reviewed

1 material concern identified.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 1 material 2 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

zizmor reported unpinned-uses

Minor caution · high confidence

The workflow uses a version tag instead of a fixed commit hash for a standard GitHub action. If someone moved that tag to malicious code, the workflow could run it. This is a common but avoidable supply-chain weakness.

Technical evidence

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The workflow references actions/checkout@v6 using a mutable major-version tag rather than a pinned commit SHA. If the tag were moved to a malicious commit, the action would execute with the job's contents:write and id-token:write permissions. This is a first-party GitHub action and persist-credentials is set to false, reducing practical risk, but tag-based pinning remains a supply-chain weakness.

Impact: low · Exploitability: unlikely

Developer action: Pin actions/checkout to a full commit SHA for reproducible and tamper-resistant CI runs.

Scanner
zizmor 1.28.0
Rule
unpinned-uses
File role
tooling
Source
.github/workflows/friction-log.yml:34

zizmor reported unpinned-uses

Minor caution · high confidence

The workflow runs a third-party tool using a version tag instead of a fixed commit hash, with broad permissions including the ability to write repository contents and issue identity tokens. If that tool's tag were moved to malicious code, it could abuse those permissions. Pinning to a specific commit would prevent this.

Technical evidence

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The workflow references wevm/frog/reconcile@v1, a third-party action, using a mutable major-version tag. The job grants contents:write, id-token:write, and pull-requests:write permissions. If the upstream tag were moved to a malicious commit, the action would execute with these elevated permissions, enabling repository tampering or OIDC token abuse. The risk is mitigated by the job's actor-id gate on issue_comment triggers, but tag-based pinning for a third-party action with id-token:write is a notable supply-chain weakness.

Impact: low · Exploitability: unlikely

Developer action: Pin wevm/frog/reconcile to a full commit SHA and verify that id-token:write is required; remove it if the action does not need OIDC token issuance.

Scanner
zizmor 1.28.0
Rule
unpinned-uses
File role
tooling
Source
.github/workflows/friction-log.yml:40
Expected scanner matches (0)

None.

Coverage and limitations

JavaScript coverage

Unresolved JavaScript stages

Tools

Limitations

Technical scan identity