SEC013 — insecure-commands

Severity: warning · Category: Security

What it checks

Flags a step whose env: sets ACTIONS_ALLOW_UNSECURE_COMMANDS to a truthy value.

Why it matters

GitHub deprecated the ::set-env::/::add-path:: workflow commands in 2020 specifically because any process that can write to a step's stdout — including a compromised or malicious dependency — could use them to inject arbitrary environment variables or PATH entries into later steps. ACTIONS_ALLOW_UNSECURE_COMMANDS exists only to re-enable that legacy, injectable behavior for backward compatibility.

Examples

Flagged:

steps:
  - name: Add tool to PATH
    run: echo "::add-path::$HOME/.local/bin"
    env:
      ACTIONS_ALLOW_UNSECURE_COMMANDS: true

Fixed — write directly to the GITHUB_PATH environment file instead, which isn't vulnerable to stdout injection:

steps:
  - name: Add tool to PATH
    run: echo "$HOME/.local/bin" >> "$GITHUB_PATH"

Suppressing

The finding is reported on the step's own first line, not the env: line — the comment has to go there to match:

  - name: Add tool to PATH # vlotpipe: ignore[SEC013]
    run: echo "::add-path::$HOME/.local/bin"
    env:
      ACTIONS_ALLOW_UNSECURE_COMMANDS: true

Rarely needed — the GITHUB_ENV/GITHUB_PATH file-based replacement covers nearly every legitimate use case the legacy commands supported.