atxtechbro / atxtechbro/dotfiles
Security: Add user authorization to Claude GitHub Actions workflows
- Dominant language
- Shell
- Stars
- 27
- Forks
- 2
- PR merge metrics
- No merged PRs in 30d
Description
## Security Vulnerability
Currently, ANY GitHub user can trigger Claude to take actions in this repository:
### Current Issues
1. **auto-trigger-claude.yml**: Automatically triggers Claude when ANYONE opens an issue
2. **claude-implementation.yml**: Responds when ANYONE mentions @claude in comments
### Impact
- Unauthorized users could trigger Claude to create PRs
- Potential for abuse of API tokens and resources
- No authentication checks on who can invoke Claude
### Proposed Fix
Add user authorization checks to both workflows:
#### auto-trigger-claude.yml
```yaml
jobs:
auto-trigger-claude:
if: github.event.issue.user.login == 'atxtechbro' # Add this line
runs-on: ubuntu-latest
```
#### claude-implementation.yml
```yaml
jobs:
claude-assistant:
if: contains(github.event.comment.body, '@claude') && github.event.comment.user.login == 'atxtechbro' # Modified condition
runs-on: ubuntu-latest
```
### Alternative: Whitelist Approach
For future flexibility with trusted collaborators:
```yaml
if: contains(fromJson('["atxtechbro", "trusted-user-2"]'), github.event.comment.user.login)
```
### Priority
**HIGH** - This is a security issue that should be fixed immediately to prevent unauthorized use of Claude and potential abuse of repository resources.
Contributor guide
No contributing guide indexed for this repository
Research direction
Inspect auto-trigger-claude.yml and claude-implementation.yml, starting with their job-level conditions and the issue or comment user fields. Verify that only the specified authorized user, or an explicitly defined whitelist, can trigger each workflow, and confirm that unauthorized issue creation and @claude comments do not start jobs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions
- Domain
- ci-cd, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100