The issue was that an untrusted source could provide specially crafted yaml to gain the same level of access as the user running the ruby program. I would argue, the yaml in your repository isn't an untrusted source. Also, exploiting this would be a very round-about method, since you could just use the local check to execute whatever you want. Finally, `safe_load` is only available in ruby 2.1, so this wouldn't work for any other rubies.