A pull_request_target workflow has access to a write-capable token and repository secrets. It checks out the external contributor head commit and executes its install script. What is the central security issue?

1. The contributor code becomes trusted automatically because the workflow file came from the base repository.
2. A pinned checkout action makes every file downloaded from the pull request safe.
3. The risk disappears if the job is renamed pull-request-validation.
4. Untrusted pull request code is executing in a privileged workflow context.