Kusari Analysis Results:

The dependency analysis found no issues. However, the code analysis identified a least-privilege violation in .github/workflows/slash-commands.yml: 'issues: write' and 'pull-requests: write' permissions are declared at the workflow level rather than scoped to the specific job that requires them. This unnecessarily exposes all jobs in the workflow to broad write permissions. If any job in this workflow were compromised (e.g., via a malicious dependency or injected input), an attacker could leverage these inherited write permissions to tamper with issues or pull requests. The fix is straightforward: move the write permissions down to the specific job (dispatch-slash-command) that needs them, and set the top-level permissions block to read-only (contents: read). This must be addressed before merging.

Required Code Mitigations

Move write permissions from the workflow level to the specific job level. Keep the top-level permissions block minimal (read-only) and add the required write permissions directly under the job that needs them.

• Location: .github/workflows/slash-commands.yml:23

• Potential Code Fix:

permissions:
  contents: read

jobs:
  dispatch-slash-command:
    name: Dispatch Slash Command
    permissions:
      issues: write
      pull-requests: write

@kusari-inspector rerun - Trigger a re-analysis of this PR
@kusari-inspector feedback [your message] - Send feedback to our AI and team
See Kusari's documentation for setup and configuration.
Commit: 7548223, performed at: 2026-05-02T20:29:12Z

Found this helpful? Give it a 👍 or 👎 reaction!