This shouldn’t work—but it absolutely does.

This is most definetely a malicious line, from the service name to the ExecStart command that contains the classic attack pattern. With wget a payload gets downloaded, which gets send to stdout and is ...

"Delegate to an executor agent (e.g., oh-my-claudecode:executor) for notebook edits.", Bash: "Delegate to an executor agent for build/install commands, or a devops agent for infrastructure commands.", ...

Breakdown of the Trivy GitHub Actions attack, including workflow misconfigurations, token theft, and supply chain exposure.