You're completely mistaken about the architecture, lol. ghost is not some payload running inside your Actions pipeline. It's a local client-side CLI that orches

You're completely mistaken about the architecture, lol. ghost is not some payload running inside your Actions pipeline. It's a local client-side CLI that orchestrates your GH account to configure ephemeral dev boxes for interactive and agentic work: debugging, building, testing. Just like on your local box, but in a clean slate, safe, reproducible machine. I actually had to go look up who TeamPCP even was, so I definitely need to clear up this wild misunderstanding. The irony of this whole thread is incredibly thick. By using ghost, developers are doing exactly what security professionals recommend! If you want to test a sketchy npm package or let an AI coding agent run wild, doing it in an isolated, ephemeral GitHub Actions runner (where your SSH keys are safely agent-forwarded, not stored) is 100x safer than running it on your local MacBook where your real AWS keys and passwords live. I literally built a utility that protects you against supply chain attacks by giving you safe, disposable sandboxes on demand. And the crowd here, 'spooked' by recent news which I wasn't even aware of, lol, too innocent -- is projecting their panic onto it and accusing ghost of being the exact thing it defends against. Truly a classic case of crowd madness. I was just happily building a better CLI to do my dev work while y'all were out here writing spy novels.