Security: Fix 3 findings in GitHub Actions workflows

[jpr5]

Security: 3 findings across 1 rule

Fixed (deterministic, no AI)

shell-injection-expr — What is this?

• claude.yml line 58: Attacker-controllable expression ${{ github.event.comment.body }} in run: block — shell injection risk
• issue.yml line 19: Attacker-controllable expression ${{ github.event.issue.body }} in run: block — shell injection risk

Requires manual review

shell-injection-expr — What is this?

• claude.yml line 70: Attacker-controllable expression ${{ github.event.comment.body }} in run: block — shell injection risk
  • Fix: Move to env: block and reference as $ENV_VAR in the shell

How this was detected

This finding was identified by deterministic pattern matching — no AI or machine learning was used in the detection. Sentinel uses static analysis rules that match known-vulnerable YAML patterns against a database of documented exploit vectors. Every finding maps to a specific, reproducible pattern. Source code is open for inspection.

---

_{🛡️ This PR was generated by Sentinel, an open-source security scanner. Why this PR? · Free, no tracking}

✅ Add Sentinel to this repo · 🚫 Opt out of future PRs

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[al-one]

Thanks for working on this. Moving untrusted GitHub event text out of inline ${{ ... }} expressions and into env: is the right direction, but I think there is one blocker in the current patch:

In .github/workflows/claude.yml, this change:

echo '$COMMENT_BODY'

uses single quotes, so the shell will not expand the variable. That means EVENT_PROMPT will contain the literal string $COMMENT_BODY instead of the actual comment body, and the later Claude step will not receive the user’s real prompt text.

issue.yml does not seem to have the same problem, because $ISSUE_BODY is expanded inside the heredoc, but claude.yml looks functionally broken in its current form.

I think this should be changed to a form that still avoids inline GitHub expression interpolation but allows normal shell expansion (for example echo "$COMMENT_BODY"), and then re-tested.

Also, claude.yml still has another inline untrusted expression in the “Check pull request” block, so this PR does not fully resolve all of the findings it describes.