[CI/CD Security] fluttercandies/flexbox_layout - Issue Report

[github-actions]

📦 fluttercandies/flexbox_layout

📌 Commit SHA: 4cc8875efcf806e1813cfc12f58dea26ca9c511a

🕜 Report generated at: 2026-08-13T18:18:27.001Z

🔍 Overview

Severity	Count
🟢 Low	40

📁 Details

📄 .github/workflows/build-all-platforms.yml - 🟢Low(40)

1	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L153
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}/android/app
            printf '\n# Signing config\n' >> gradle.properties
            printf 'RELEASE_STORE_FILE=${{ env.ANDROID_KEYSTORE_FILE }}\n' >> gradle.properties
            printf 'RELEASE_STORE_PASSWORD=${{ env.ANDROID_KEYSTORE_SECRET }}\n' >> gradle.properties
            printf 'RELEASE_KEY_ALIAS=${{ env.ANDROID_KEY_ALIAS }}\n' >> gradle.properties
  ...

• .github/workflows/build-all-platforms.yml#L152
  Audit: this run block

  run

---

2	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L155
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}/android/app
            printf '\n# Signing config\n' >> gradle.properties
            printf 'RELEASE_STORE_FILE=${{ env.ANDROID_KEYSTORE_FILE }}\n' >> gradle.properties
            printf 'RELEASE_STORE_PASSWORD=${{ env.ANDROID_KEYSTORE_SECRET }}\n' >> gradle.properties
            printf 'RELEASE_KEY_ALIAS=${{ env.ANDROID_KEY_ALIAS }}\n' >> gradle.properties
  ...

• .github/workflows/build-all-platforms.yml#L152
  Audit: this run block

  run

---

3	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L156
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}/android/app
            printf '\n# Signing config\n' >> gradle.properties
            printf 'RELEASE_STORE_FILE=${{ env.ANDROID_KEYSTORE_FILE }}\n' >> gradle.properties
            printf 'RELEASE_STORE_PASSWORD=${{ env.ANDROID_KEYSTORE_SECRET }}\n' >> gradle.properties
            printf 'RELEASE_KEY_ALIAS=${{ env.ANDROID_KEY_ALIAS }}\n' >> gradle.properties
  ...

• .github/workflows/build-all-platforms.yml#L152
  Audit: this run block

  run

---

4	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L157
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}/android/app
            printf '\n# Signing config\n' >> gradle.properties
            printf 'RELEASE_STORE_FILE=${{ env.ANDROID_KEYSTORE_FILE }}\n' >> gradle.properties
            printf 'RELEASE_STORE_PASSWORD=${{ env.ANDROID_KEYSTORE_SECRET }}\n' >> gradle.properties
            printf 'RELEASE_KEY_ALIAS=${{ env.ANDROID_KEY_ALIAS }}\n' >> gradle.properties
  ...

• .github/workflows/build-all-platforms.yml#L152
  Audit: this run block

  run

---

5	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L158
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}/android/app
            printf '\n# Signing config\n' >> gradle.properties
            printf 'RELEASE_STORE_FILE=${{ env.ANDROID_KEYSTORE_FILE }}\n' >> gradle.properties
            printf 'RELEASE_STORE_PASSWORD=${{ env.ANDROID_KEYSTORE_SECRET }}\n' >> gradle.properties
            printf 'RELEASE_KEY_ALIAS=${{ env.ANDROID_KEY_ALIAS }}\n' >> gradle.properties
  ...

• .github/workflows/build-all-platforms.yml#L152
  Audit: this run block

  run

---

6	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L168
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}/android/app
            printf '\n# Signing config\n' >> gradle.properties
            printf 'RELEASE_STORE_FILE=${{ env.ANDROID_KEYSTORE_FILE }}\n' >> gradle.properties
            printf 'RELEASE_STORE_PASSWORD=${{ env.ANDROID_KEYSTORE_SECRET }}\n' >> gradle.properties
            printf 'RELEASE_KEY_ALIAS=${{ env.ANDROID_KEY_ALIAS }}\n' >> gradle.properties
  ...

• .github/workflows/build-all-platforms.yml#L152
  Audit: this run block

  run

---

7	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L169
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}/android/app
            printf '\n# Signing config\n' >> gradle.properties
            printf 'RELEASE_STORE_FILE=${{ env.ANDROID_KEYSTORE_FILE }}\n' >> gradle.properties
            printf 'RELEASE_STORE_PASSWORD=${{ env.ANDROID_KEYSTORE_SECRET }}\n' >> gradle.properties
            printf 'RELEASE_KEY_ALIAS=${{ env.ANDROID_KEY_ALIAS }}\n' >> gradle.properties
  ...

• .github/workflows/build-all-platforms.yml#L152
  Audit: this run block

  run

---

8	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L170
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}/android/app
            printf '\n# Signing config\n' >> gradle.properties
            printf 'RELEASE_STORE_FILE=${{ env.ANDROID_KEYSTORE_FILE }}\n' >> gradle.properties
            printf 'RELEASE_STORE_PASSWORD=${{ env.ANDROID_KEYSTORE_SECRET }}\n' >> gradle.properties
            printf 'RELEASE_KEY_ALIAS=${{ env.ANDROID_KEY_ALIAS }}\n' >> gradle.properties
  ...

• .github/workflows/build-all-platforms.yml#L152
  Audit: this run block

  run

---

9	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L171
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}/android/app
            printf '\n# Signing config\n' >> gradle.properties
            printf 'RELEASE_STORE_FILE=${{ env.ANDROID_KEYSTORE_FILE }}\n' >> gradle.properties
            printf 'RELEASE_STORE_PASSWORD=${{ env.ANDROID_KEYSTORE_SECRET }}\n' >> gradle.properties
            printf 'RELEASE_KEY_ALIAS=${{ env.ANDROID_KEY_ALIAS }}\n' >> gradle.properties
  ...

• .github/workflows/build-all-platforms.yml#L152
  Audit: this run block

  run

---

10	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L185
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}
            if [ "${{ matrix.arch }}" = "universal" ]; then
              flutter build apk --release --target-platform android-arm64,android-x64
            else
              flutter build apk --release --target-platform android-${{ matrix.arch }}
  ...

• .github/workflows/build-all-platforms.yml#L184
  Audit: this run block

  run

---

11	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L186
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}
            if [ "${{ matrix.arch }}" = "universal" ]; then
              flutter build apk --release --target-platform android-arm64,android-x64
            else
              flutter build apk --release --target-platform android-${{ matrix.arch }}
  ...

• .github/workflows/build-all-platforms.yml#L184
  Audit: this run block

  run

---

12	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L189
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}
            if [ "${{ matrix.arch }}" = "universal" ]; then
              flutter build apk --release --target-platform android-arm64,android-x64
            else
              flutter build apk --release --target-platform android-${{ matrix.arch }}
  ...

• .github/workflows/build-all-platforms.yml#L184
  Audit: this run block

  run

---

13	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L194
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}/build/app/outputs/flutter-apk
            if [ "${{ matrix.arch }}" = "universal" ]; then
              mv app-release.apk ${{ env.PROJECT_SLUG }}-android-universal.apk
            else
              mv app-release.apk ${{ env.PROJECT_SLUG }}-android-${{ matrix.arch }}.apk
  ...

• .github/workflows/build-all-platforms.yml#L193
  Audit: this run block

  run

---

14	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L195
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}/build/app/outputs/flutter-apk
            if [ "${{ matrix.arch }}" = "universal" ]; then
              mv app-release.apk ${{ env.PROJECT_SLUG }}-android-universal.apk
            else
              mv app-release.apk ${{ env.PROJECT_SLUG }}-android-${{ matrix.arch }}.apk
  ...

• .github/workflows/build-all-platforms.yml#L193
  Audit: this run block

  run

---

15	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L196
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}/build/app/outputs/flutter-apk
            if [ "${{ matrix.arch }}" = "universal" ]; then
              mv app-release.apk ${{ env.PROJECT_SLUG }}-android-universal.apk
            else
              mv app-release.apk ${{ env.PROJECT_SLUG }}-android-${{ matrix.arch }}.apk
  ...

• .github/workflows/build-all-platforms.yml#L193
  Audit: this run block

  run

---

16	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L198
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}/build/app/outputs/flutter-apk
            if [ "${{ matrix.arch }}" = "universal" ]; then
              mv app-release.apk ${{ env.PROJECT_SLUG }}-android-universal.apk
            else
              mv app-release.apk ${{ env.PROJECT_SLUG }}-android-${{ matrix.arch }}.apk
  ...

• .github/workflows/build-all-platforms.yml#L193
  Audit: this run block

  run

---

17	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L198
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}/build/app/outputs/flutter-apk
            if [ "${{ matrix.arch }}" = "universal" ]; then
              mv app-release.apk ${{ env.PROJECT_SLUG }}-android-universal.apk
            else
              mv app-release.apk ${{ env.PROJECT_SLUG }}-android-${{ matrix.arch }}.apk
  ...

• .github/workflows/build-all-platforms.yml#L193
  Audit: this run block

  run

---

18	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L235
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}
            flutter build ios --release --no-codesign

• .github/workflows/build-all-platforms.yml#L234
  Audit: this run block

  run

---

19	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L240
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}
            mkdir -p build/ios-bundle/Runner.app
            cp -r build/ios/iphoneos/Runner.app/* build/ios-bundle/Runner.app/
            cd build/ios-bundle
            zip -r ../../${{ env.PROJECT_SLUG }}-ios.zip .
  ...

• .github/workflows/build-all-platforms.yml#L239
  Audit: this run block

  run

---

20	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L244
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}
            mkdir -p build/ios-bundle/Runner.app
            cp -r build/ios/iphoneos/Runner.app/* build/ios-bundle/Runner.app/
            cd build/ios-bundle
            zip -r ../../${{ env.PROJECT_SLUG }}-ios.zip .
  ...

• .github/workflows/build-all-platforms.yml#L239
  Audit: this run block

  run

---

21	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L249
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}
            mkdir -p Payload
            cp -r build/ios/iphoneos/Runner.app Payload/
            zip -r ${{ env.PROJECT_SLUG }}-ios.ipa Payload
            rm -rf Payload

• .github/workflows/build-all-platforms.yml#L248
  Audit: this run block

  run

---

22	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L252
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}
            mkdir -p Payload
            cp -r build/ios/iphoneos/Runner.app Payload/
            zip -r ${{ env.PROJECT_SLUG }}-ios.ipa Payload
            rm -rf Payload

• .github/workflows/build-all-platforms.yml#L248
  Audit: this run block

  run

---

23	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L292
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}
            flutter build windows --release

• .github/workflows/build-all-platforms.yml#L291
  Audit: this run block

  run

---

24	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L300
  Audit: may expand into attacker-controllable code

  |
            $script = @"
            [Setup]
            AppName=${{ env.PROJECT_NAME }}
            AppVersion=1.0.0
            DefaultDirName={pf}\${{ env.PROJECT_NAME }}
  ...

• .github/workflows/build-all-platforms.yml#L297
  Audit: this run block

  run

---

25	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L302
  Audit: may expand into attacker-controllable code

  |
            $script = @"
            [Setup]
            AppName=${{ env.PROJECT_NAME }}
            AppVersion=1.0.0
            DefaultDirName={pf}\${{ env.PROJECT_NAME }}
  ...

• .github/workflows/build-all-platforms.yml#L297
  Audit: this run block

  run

---

26	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L302
  Audit: may expand into attacker-controllable code

  |
            $script = @"
            [Setup]
            AppName=${{ env.PROJECT_NAME }}
            AppVersion=1.0.0
            DefaultDirName={pf}\${{ env.PROJECT_NAME }}
  ...

• .github/workflows/build-all-platforms.yml#L297
  Audit: this run block

  run

---

27	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L304
  Audit: may expand into attacker-controllable code

  |
            $script = @"
            [Setup]
            AppName=${{ env.PROJECT_NAME }}
            AppVersion=1.0.0
            DefaultDirName={pf}\${{ env.PROJECT_NAME }}
  ...

• .github/workflows/build-all-platforms.yml#L297
  Audit: this run block

  run

---

28	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L313
  Audit: may expand into attacker-controllable code

  |
            $script = @"
            [Setup]
            AppName=${{ env.PROJECT_NAME }}
            AppVersion=1.0.0
            DefaultDirName={pf}\${{ env.PROJECT_NAME }}
  ...

• .github/workflows/build-all-platforms.yml#L297
  Audit: this run block

  run

---

29	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L313
  Audit: may expand into attacker-controllable code

  |
            $script = @"
            [Setup]
            AppName=${{ env.PROJECT_NAME }}
            AppVersion=1.0.0
            DefaultDirName={pf}\${{ env.PROJECT_NAME }}
  ...

• .github/workflows/build-all-platforms.yml#L297
  Audit: this run block

  run

---

30	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L313
  Audit: may expand into attacker-controllable code

  |
            $script = @"
            [Setup]
            AppName=${{ env.PROJECT_NAME }}
            AppVersion=1.0.0
            DefaultDirName={pf}\${{ env.PROJECT_NAME }}
  ...

• .github/workflows/build-all-platforms.yml#L297
  Audit: this run block

  run

---

31	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L313
  Audit: may expand into attacker-controllable code

  |
            $script = @"
            [Setup]
            AppName=${{ env.PROJECT_NAME }}
            AppVersion=1.0.0
            DefaultDirName={pf}\${{ env.PROJECT_NAME }}
  ...

• .github/workflows/build-all-platforms.yml#L297
  Audit: this run block

  run

---

32	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L316
  Audit: may expand into attacker-controllable code

  |
            $script = @"
            [Setup]
            AppName=${{ env.PROJECT_NAME }}
            AppVersion=1.0.0
            DefaultDirName={pf}\${{ env.PROJECT_NAME }}
  ...

• .github/workflows/build-all-platforms.yml#L297
  Audit: this run block

  run

---

33	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L320
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}
            & "C:\Program Files (x86)\Inno Setup 6\ISCC.exe" setup.iss

• .github/workflows/build-all-platforms.yml#L319
  Audit: this run block

  run

---

34	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L325
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}
            Compress-Archive -Path build\windows\x64\runner\Release\* -DestinationPath ${{ env.PROJECT_SLUG }}-windows.zip

• .github/workflows/build-all-platforms.yml#L324
  Audit: this run block

  run

---

35	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L326
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}
            Compress-Archive -Path build\windows\x64\runner\Release\* -DestinationPath ${{ env.PROJECT_SLUG }}-windows.zip

• .github/workflows/build-all-platforms.yml#L324
  Audit: this run block

  run

---

36	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L367
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}
            flutter build linux --release

• .github/workflows/build-all-platforms.yml#L366
  Audit: this run block

  run

---

37	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L372
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}
            tar -czf ${{ env.PROJECT_SLUG }}-linux.tar.gz -C build/linux/x64/release/bundle .

• .github/workflows/build-all-platforms.yml#L371
  Audit: this run block

  run

---

38	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L373
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}
            tar -czf ${{ env.PROJECT_SLUG }}-linux.tar.gz -C build/linux/x64/release/bundle .

• .github/workflows/build-all-platforms.yml#L371
  Audit: this run block

  run

---

39	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L406
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}
            flutter build macos --release

• .github/workflows/build-all-platforms.yml#L405
  Audit: this run block

  run

---

40	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/build-all-platforms.yml#L411
  Audit: may expand into attacker-controllable code

  |
            cd ${{ env.EXAMPLE_DIR }}
            cd build/macos/Build/Products/Release
            zip -r ../../../../../${{ env.PROJECT_SLUG }}-macos.zip .

• .github/workflows/build-all-platforms.yml#L410
  Audit: this run block

  run

---