Security: Agentic Workflow Injection in issue summary workflow via untrusted issue content

### Summary

The affected issue-summary workflow runs automatically on public `issues.opened` events, sends attacker-controlled issue title and body content to `actions/ai-inference`, and then posts the model output back to the same issue using an authenticated repository token.

This creates an externally reachable AI-driven write path where an issue author may be able to influence automated issue comments.

### Details

- trigger: `issues.opened`
- permissions: `issues: write`, `models: read`, `contents: read`
- model input includes `${{ github.event.issue.title }}` and `${{ github.event.issue.body }}`
- sink posts `steps.inference.outputs.response` with `gh issue comment`

The workflow is automatically reachable by anyone who can open an issue. Untrusted issue text is embedded directly into the LLM prompt and the resulting output is published as a repository comment without deterministic validation.

### PoC

1. Open a new issue.
2. Put instruction-like content in the title or body asking the model to emit a chosen summary.
3. Wait for the workflow to run automatically.
4. Check whether the workflow posts an attacker-influenced summary comment.

### Impact

An external issue author may be able to influence automated issue comments, producing misleading summaries or noisy maintainer-facing output under the repository's write-capable automation identity.

### Suggested Remediation

- Treat issue title/body as untrusted data rather than operative instructions.
- Avoid posting raw model output directly as an issue comment.
- Restrict this workflow to trusted actors or add human review before publishing AI output.

### Credit

Reported by Security PRIDE Research Group @security-pride