atxtechbro / atxtechbro/dotfiles

Security: Add user authorization to Claude GitHub Actions workflows

Open
#1,166 2 comments 0 reactions 0 assignees View on GitHub
automation bug github-actions high-priority security
Dominant language
Shell
Stars
27
Forks
2
PR merge metrics
No merged PRs in 30d

Description

## Security Vulnerability

Currently, ANY GitHub user can trigger Claude to take actions in this repository:

### Current Issues
1. **auto-trigger-claude.yml**: Automatically triggers Claude when ANYONE opens an issue
2. **claude-implementation.yml**: Responds when ANYONE mentions @claude in comments

### Impact
- Unauthorized users could trigger Claude to create PRs
- Potential for abuse of API tokens and resources
- No authentication checks on who can invoke Claude

### Proposed Fix

Add user authorization checks to both workflows:

#### auto-trigger-claude.yml
```yaml
jobs:
auto-trigger-claude:
if: github.event.issue.user.login == 'atxtechbro' # Add this line
runs-on: ubuntu-latest
```

#### claude-implementation.yml
```yaml
jobs:
claude-assistant:
if: contains(github.event.comment.body, '@claude') && github.event.comment.user.login == 'atxtechbro' # Modified condition
runs-on: ubuntu-latest
```

### Alternative: Whitelist Approach
For future flexibility with trusted collaborators:
```yaml
if: contains(fromJson('["atxtechbro", "trusted-user-2"]'), github.event.comment.user.login)
```

### Priority
**HIGH** - This is a security issue that should be fixed immediately to prevent unauthorized use of Claude and potential abuse of repository resources.

Contributor guide

No contributing guide indexed for this repository

Research direction

Inspect auto-trigger-claude.yml and claude-implementation.yml, starting with their job-level conditions and the issue or comment user fields. Verify that only the specified authorized user, or an explicitly defined whitelist, can trigger each workflow, and confirm that unauthorized issue creation and @claude comments do not start jobs.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions
Domain
ci-cd, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.