README Reality Check treats every scanned README and repository file as untrusted. Its threat model includes malicious documentation designed to make an analyzer execute shell code, follow a symlink outside the checkout, load project code, or exfiltrate secrets.

The analyzer never executes README content, package scripts, installers, or user-provided commands. It does not access the network, dynamically import from the scanned repository, inspect secrets, or follow symlinks outside the configured repository root. Shell parsing is intentionally conservative and unsupported constructs are skipped. The Action requires only contents: read; use it with pull_request, not pull_request_target.

Please report vulnerabilities privately to the maintainers rather than filing a public issue.