Fix Claude Review error

[genedna]

No description provided.

[github-actions]

Claude finished @genedna's task in 1m 13s —— View job

---

Code Review

• Gathering context
• Analyzing changes
• Providing review feedback

---

This PR makes two changes to .github/workflows/claude-review.yml:

1. Adds allowed_non_write_users: "*" (line 111)
2. Broadens the --allowedTools argument from specific commands to wildcards (line 152)

---

Security

allowed_non_write_users: "*" — Broad permission grant

allowed_non_write_users: "*"

This allows any GitHub user (including external contributors and the public) to trigger Claude via @claude mentions. Combined with pull_request_target (which runs with the base repository's secrets), this has two risks:

• Cost exposure: Any public user can invoke the Anthropic API on your key with no rate limit.
• Prompt injection surface: Malicious content in PR diffs could attempt to hijack Claude's actions.

The pull_request_target trigger is safer than pull_request for fork code execution, but this setting is still broader than necessary. If the intent is to allow all contributors to request reviews, consider whether restricting to org members or specific users would be appropriate.

---

Bash(gh) wildcard — Over-permissive tool scope

Before:

--allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"

After:

--allowedTools "mcp__github__,mcp__github_inline_comment__,Bash(gh)"

The new Bash(gh) permits any gh CLI subcommand, including destructive or unintended operations like gh issue close, gh release create, gh repo edit, etc. Similarly, mcp__github__ is a prefix wildcard that grants access to all MCP GitHub tools beyond just inline comments.

The original was restrictive by design — specifying only the minimum gh subcommands needed. The fix appears to have been made to resolve a runtime error (Claude trying to use tools outside the allowlist), but it overcorrects by granting unrestricted gh access.

Recommendation: Identify which specific tools caused the error and add only those to the allowlist rather than using open-ended wildcards. For example:

claude_args: |
  --allowedTools "mcp__github_comment__update_claude_comment,mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh api:*)"

Fix this →

---

Summary

Change	Assessment
allowed_non_write_users: "*"	Functional fix but broad — acceptable if open contribution is intended, but increases cost/injection risk
Bash(gh) wildcard	Over-permissive — narrows the security boundary of Claude's tool access; recommend using specific subcommands
mcp__github__ wildcard	Similarly broad — consider enumerating only needed MCP tools

The fix resolves the immediate error but trades specificity for permissiveness. For a workflow running with repository secrets, tightening the tool scope is recommended.

[Copilot]

Pull request overview

This pull request modifies the Claude code review workflow to address errors, but makes two significant security-related changes that dramatically expand access and capabilities. The PR title suggests this is fixing an error, but the changes introduce new security considerations rather than simple bug fixes.

Changes:

• Added allowed_non_write_users: "*" to allow any user (including those without repository write access) to trigger Claude reviews
• Broadened the --allowedTools parameter from an explicit whitelist of specific commands to wildcard patterns that allow all GitHub MCP tools and all gh CLI commands

[Copilot]

Setting allowed_non_write_users to "*" allows anyone (including external contributors without write access) to trigger Claude code reviews by mentioning @claude in comments. This could enable malicious actors to:

1. Trigger expensive Claude API calls, leading to cost abuse
2. Potentially extract sensitive information from the codebase through carefully crafted prompts
3. Use the workflow as a resource exhaustion vector

If this is intentional for an open-source project, consider adding rate limiting or restricting this to specific users/organizations instead of a wildcard. If not intentional, remove this line to use the default behavior which typically restricts triggering to users with write access.

Suggested change

allowed_non_write_users: "*"

[Copilot]

The allowedTools parameter has been broadened from specific commands to wildcard patterns. The previous configuration explicitly restricted Claude to only:

• create_inline_comment for GitHub
• gh pr comment, gh pr diff, gh pr view for Bash

The new configuration allows:

• ALL mcp__github__ tools (not just inline comments)
• ALL mcp__github_inline_comment__ operations
• ALL gh commands (not just pr-related ones)

This significantly expands Claude's capabilities and could allow unintended actions like creating/deleting branches, merging PRs, modifying workflow files, or running arbitrary gh commands. The original restrictive approach was more secure. Unless there's a specific need for these additional capabilities, revert to the explicit whitelist or carefully enumerate only the required tools.

Suggested change

	--allowedTools "mcp__github__,mcp__github_inline_comment__,Bash(gh)"
	--allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh(pr comment,pr diff,pr view))"

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ea558cee58

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Restrict Claude Bash access to specific gh subcommands

In the workflow section I inspected (.github/workflows/claude-review.yml), changing --allowedTools to Bash(gh) grants Claude access to run any GitHub CLI command, while this job’s token still has pull-requests: write, issues: write, and actions: write. That materially expands the blast radius from “review/comment” into repository mutation if the model is steered by untrusted PR content or prompt injection; the allowlist should stay scoped to the minimal gh subcommands required for review.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Remove wildcard non-writer allowlist for review trigger

Setting allowed_non_write_users: "*" in this pull_request_target review job opens invocation to all non-write users, including external contributors, while the run uses a write-scoped GITHUB_TOKEN and a paid Anthropic API key. This introduces an abuse path (cost amplification and write-capable automation by untrusted actors) that did not exist with a constrained allowlist, so the list should be explicit and limited to trusted users.

Useful? React with 👍 / 👎.