npm-audit-action/src/workdir.ts

export function isValid(dir: string): boolean {
  return !dir.startsWith('/') && !dir.startsWith('..')
}