Comment by OutOfHere

Why do people still use others untrusted Actions, especially without hashes? Just have an LLM write whatever script you need to do it yourself using the necessary tools.

Granted, if the underlying CLI tool itself is compromised, then avoiding the associated Action won't help you.