# Upstream helpers for gha-security-review

The files listed below were recovered from [getsentry/skills](https://github.com/getsentry/skills) at commit `d18b7aa8ba878354e5c348310230e652f7690f9c`. The repository ID is `1128612043`.

They retain the upstream **Apache-2.0** license reproduced in [UPSTREAM-LICENSE.txt](UPSTREAM-LICENSE.txt). This notice applies to the listed support files; it does not replace the license metadata of other catalog files. Preserve the upstream license and this attribution when redistributing them.

License wording is unchanged; text-only trailing whitespace and EOF blank lines are normalized. Original license: https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/LICENSE

| Local file | Original upstream path | Original Git blob SHA | Import changes |
| --- | --- | --- | --- |
| `references/pwn-request.md` | `skills/gha-security-review/references/pwn-request.md` | `0a2046843146aaff7dd09e303715e0bda0e0db89` | text-only trailing whitespace and EOF blank lines normalized; remote-execution examples replaced with non-operational symbols |
| `references/comment-triggered-commands.md` | `skills/gha-security-review/references/comment-triggered-commands.md` | `a1d651ed35ec333c9afcaf328cadca4c6b7fb5e4` | text-only trailing whitespace and EOF blank lines normalized; remote-execution examples replaced with non-operational symbols |
| `references/expression-injection.md` | `skills/gha-security-review/references/expression-injection.md` | `dca326d2f7067b8921c4fc47e01ccc8a56bb6c78` | text-only trailing whitespace and EOF blank lines normalized; remote-execution examples replaced with non-operational symbols |
| `references/credential-escalation.md` | `skills/gha-security-review/references/credential-escalation.md` | `805a301dff90376a947cab3ab953074378814e57` | text-only trailing whitespace and EOF blank lines normalized |
| `references/ai-prompt-injection-via-ci.md` | `skills/gha-security-review/references/ai-prompt-injection-via-ci.md` | `be1c9497f4c140818dd2bc925244fa0d3a48d53e` | text-only trailing whitespace and EOF blank lines normalized |
| `references/supply-chain.md` | `skills/gha-security-review/references/supply-chain.md` | `7a9d1a012dcef748de83b5960bce715ffc3758c0` | text-only trailing whitespace and EOF blank lines normalized; remote-execution examples replaced with non-operational symbols |
| `references/permissions-and-secrets.md` | `skills/gha-security-review/references/permissions-and-secrets.md` | `3a809e928c13d537af5527dcf3c7fbe63d588c03` | text-only trailing whitespace and EOF blank lines normalized |
| `references/runner-infrastructure.md` | `skills/gha-security-review/references/runner-infrastructure.md` | `6aafbdbf62e29cc3ca6355bd31bc3780672f9120` | text-only trailing whitespace and EOF blank lines normalized |
| `references/real-world-attacks.md` | `skills/gha-security-review/references/real-world-attacks.md` | `2b24e2a5b30a0463d2a750d752a68d9b05799418` | text-only trailing whitespace and EOF blank lines normalized; remote-execution examples replaced with non-operational symbols |

2026-10-23 adaptations: corrected blanket-safe trigger/input claims, cache scope/artifact trust, secret/PAT/OIDC and association assumptions, lifecycle/init execution facts and campaign year/count certainty. Apache-2.0 retained. Static review only; no payload or workflow executed.