A GitHub Actions script used to prepare tarballs and update GitHub Checks statuses and PR comments was mis-structured. The script mixed code running with higher privileges, specifically a single-use token with write permissions, and untrusted inputs from the PR source branch. This flaw allows a malicious pull request from a fork to extract the `GITHUB TOKEN` value. While the token is valid during the GitHub Actions job execution, it could be used to manipulate Git repository contents, commit checks, statuses, or issue and PR comments based on the assigned permissions.