A retained website title claims command injection in dbt’s GitHub Actions where a comment becomes the path to shell execution. The local packet does not include the article body, so the useful click is the CI trust-boundary question rather than a validated exploit narrative.