fix: remove unsafe exec() in action.go

[orbisai0security]

Summary

Fix critical severity security issue in pkg/runner/action.go.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	pkg/runner/action.go:451

Description: The populateEnvsFromInput() function reads action input values and writes them directly into the step environment map without sanitizing newline characters (\n, \r) or null bytes. When the environment map is serialized to the GitHub Actions environment file protocol format (envs.txt), unsanitized newlines allow an attacker to inject additional key=value pairs. Downstream shell steps that expand these injected variables without quoting will execute attacker-controlled commands within the CI/CD pipeline.

Changes

• pkg/runner/action.go

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security