Workflow "Claude Code" can be triggered by any GitHub user commenting "@​claude"

[liuchunyi-buaa]

Description

The claude job in .github/workflows/claude.yml (lines 15-19) is triggered
solely by a comment/issue containing the substring @​claude, with no check on
who wrote it:

if: |
  (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@​claude')) ||
  (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@​claude')) ||
  (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@​claude')) ||
  (github.event_name == 'issues' && (contains(github.event.issue.body, '@​claude') || contains(github.event.issue.title, '@​claude')))

Any GitHub user can therefore start the job by commenting @​claude ... on an
issue, PR, or review. The job then runs with:

• secrets.ANTHROPIC_API_KEY (line 37) — the API key is exposed to the run
• --allowedTools "Bash,mcp__mcp-docs,WebFetch" (line 48) — the agent gets a
  shell on the runner
• permissions: id-token: write (line 25) — OIDC token minting
• actions: read (line 26), plus the third-party
  anthropics/claude-code-action@v1 pinned to a mutable tag

Because the triggering comment's text flows into the LLM agent's context, this
is the classic "prompt injection into a privileged CI agent" surface: an
untrusted commenter can spend the project's API quota on arbitrary agent runs,
and malicious instructions in the comment can steer an agent that holds Bash
access, the API key, and OIDC capabilities.

Trigger scenario

1. Anyone opens an issue, comments on an issue/PR, or submits a PR review and
   includes @​claude plus arbitrary instructions in the text.
2. The workflow runs on ubuntu-latest with the permissions above, regardless
   of the commenter's role (no author_association check).
3. The comment text is processed by the agent with Bash access.

Impact

• Unauthorized use of the ANTHROPIC_API_KEY on agent runs (billable).
• Prompt-injection-driven actions within the runner's permissions (repository
  contents read, PR/issue read, OIDC token, actions metadata).
• Abuse of repository CI resources.

Suggested fix

Gate the job on trusted actors, e.g.:

if: |
  (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@​claude') && contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) ||
  ...

Additionally: restrict the tools exposed to externally-triggered runs (or drop
Bash), remove id-token: write if it is not actually used, and pin
anthropics/claude-code-action to a full commit SHA.

I'd be happy to open a PR implementing the author_association gate (and any
of the other hardening bits) if that's welcome. Thanks for maintaining the
reference servers!