Claude ae2fd1754a fix: prevent command injection in test-failure-analysis example ...

Fix command injection vulnerability where github.event.workflow_run.head_branch
was directly interpolated into shell commands. Branch names containing shell
metacharacters could execute arbitrary commands.

Changes:
- Pass head_branch through environment variables instead of direct interpolation
- Affects gh pr list --head and gh workflow run --ref commands
- Prevents execution of malicious code in branch names

Severity: HIGH
Category: command_injection

2025-12-13 20:47:58 +00:00

4.4 KiB

Raw Blame History

View Raw