Hello maintainers,
I would like to report a potential vulnerability in your GitHub CI workflows.
Affected files:
- checkly/docs/.github/workflows/claude-code.yml
Vulnerability:
- In job 'claude-respond', step 'Run Claude Code', the attacker-controlled source '${{ github.event.issue.body || github.event.comment.body }}' is spliced into the
run shell sink, allowing for command injection.
Thank you for your time and for maintaining this project.