Workflow "Claude Code" can be triggered by any GitHub user commenting "@​claude"

Description

The claude job in .github/workflows/claude.yml (lines 15-19) is triggered solely by a comment/issue containing the substring @​claude, with no check on who wrote it:

if: |
  (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@​claude')) ||
  (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@​claude')) ||
  (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@​claude')) ||
  (github.event_name == 'issues' && (contains(github.event.issue.body, '@​claude') || contains(github.event.issue.title, '@​claude')))

Any GitHub user can therefore start the job by commenting @​claude ... on an issue, PR, or review. The job then runs with:

• secrets.ANTHROPIC_API_KEY (line 37) — the API key is exposed to the run
• --allowedTools "Bash,mcp__mcp-docs,WebFetch" (line 48) — the agent gets a shell on the runner
• permissions: id-token: write (line 25) — OIDC token minting
• actions: read (line 26), plus the third-party anthropics/claude-code-action@v1 pinned to a mutable tag

Because the triggering comment's text flows into the LLM agent's context, this is the classic "prompt injection into a privileged CI agent" surface: an untrusted commenter can spend the project's API quota on arbitrary agent runs, and malicious instructions in the comment can steer an agent that holds Bash access, the API key, and OIDC capabilities.

Trigger scenario

1. Anyone opens an issue, comments on an issue/PR, or submits a PR review and includes @​claude plus arbitrary instructions in the text.
2. The workflow runs on ubuntu-latest with the permissions above, regardless of the commenter's role (no author_association check).
3. The comment text is processed by the agent with Bash access.

Impact

• Unauthorized use of the ANTHROPIC_API_KEY on agent runs (billable).
• Prompt-injection-driven actions within the runner's permissions (repository contents read, PR/issue read, OIDC token, actions metadata).
• Abuse of repository CI resources.

Suggested fix

Gate the job on trusted actors, e.g.:

if: |
  (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@​claude') && contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) ||
  ...

Additionally: restrict the tools exposed to externally-triggered runs (or drop Bash), remove id-token: write if it is not actually used, and pin anthropics/claude-code-action to a full commit SHA.

I'd be happy to open a PR implementing the author_association gate (and any of the other hardening bits) if that's welcome. Thanks for maintaining the reference servers!