claude-botandClaude Opus 4.8
14aa641560
ci/woodpecker/pr/pr-review Pipeline was successful
The pr-review triage agent runs with an unscoped Write tool and its cwd contains ./.pr-review (-> $D), so a prompt-injected diff could make it overwrite ./.pr-review/models.txt and then name a smuggled token as its `model`. Validation re-read models.txt FROM DISK after the triage ran, so the catalog-membership check was defeated by the agent's own writeback -- letting an attacker force a weaker real model, or a syntactically-valid fake id that makes the review's `claude --model <fake>` fail and silently suppress the review entirely. Validate against $MODELS_TABLE -- the catalog captured in a shell variable BEFORE the triage runs -- instead of re-reading the file the triage can overwrite. This mirrors pick-model.sh, which already validates against its in-memory table before its (tool-less) picker runs. The triage still reads models.txt for its own pick; tampering only misleads that pick, which is then rejected against the pristine snapshot -> CLI default (so the review still runs, it can't be suppressed). Verified: a token present only in a tampered on-disk file but absent from the pre-triage snapshot is now rejected (it was accepted before). Added a regression test to scripts/ci/test-model-selection.sh, and fixed the header comment to note the complex-review override as another path to the CLI default. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>