The folks at Synaktiv had a nice detailed blog post on this same vector last year[1].

The bottom line with these kinds of things is that virtually nobody should be using `pull_request_target`, even with “trusted” machine actors like Dependabot. It’s a pretty terrible footgun.

[1]: https://www.synacktiv.com/en/publications/github-actions-exp...