From 7f7a091de61370b6422a8caab0b511fe018146b6 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 6 Aug 2026 00:53:25 +0000 Subject: [PATCH] fix(github): allowlist remote detection in triage-prs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The skill's pre-execution remote detection failed its permission check on every invocation. The checker splits compound commands on `||` and validates each part independently, and the skill's `allowed-tools` had no `Bash(git remote ...)` entry at all, so both `git remote get-url` parts came back as requiring approval. The trailing `echo` was already safe by default. Allowlist the split parts rather than restructuring the command. The chained form is deterministic — the shell picks `upstream` over `origin` and emits a single URL or the `__NO_REMOTE__` sentinel, including when run outside a git repository — so Phase 1 parses one value instead of choosing between remotes itself. `get-url` is read-only, so a wildcard on the remote name covers both parts without widening beyond reads. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_0195QVgZcRJjTBKKDJQjoEr3 --- github/.claude-plugin/plugin.json | 2 +- github/skills/triage-prs/SKILL.md | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/github/.claude-plugin/plugin.json b/github/.claude-plugin/plugin.json index bac1079..7baca4f 100644 --- a/github/.claude-plugin/plugin.json +++ b/github/.claude-plugin/plugin.json @@ -1,7 +1,7 @@ { "name": "github", "description": "GitHub MCP server with selected toolsets for repository management, code security, discussions, notifications, and more.", - "version": "1.3.0", + "version": "1.3.1", "author": { "name": "GitHub" }, diff --git a/github/skills/triage-prs/SKILL.md b/github/skills/triage-prs/SKILL.md index 26daf80..e1565c9 100644 --- a/github/skills/triage-prs/SKILL.md +++ b/github/skills/triage-prs/SKILL.md @@ -9,6 +9,7 @@ description: >- disable-model-invocation: true argument-hint: '[owner/repo]' allowed-tools: + - Bash(git remote get-url *) - Bash(gh api */pulls/*/requested_reviewers -X DELETE *) - mcp__plugin_github_github__get_me - mcp__plugin_github_github__search_pull_requests