justinmclean commented on PR #4244: URL: https://github.com/apache/iggy/pull/4244#issuecomment-5770077311
The rewrite is solid. No PR code runs. The key can't be read without a shell, and there's no shell. The gap left is the review itself. The comment text and the verdict are written by the model, and the model reads the PR under review, so a PR can prompt-inject them. The poster prints that text as github-actions[bot]. It's only ever a comment, so it can't approve, merge or run anything. But a PR can make the bot say "looks good, safe to merge", print a Verdict: APPROVE that the findings don't support, hide instructions in a <details> block for whoever's AI reads the thread next, or drop a link or an @-ping. Two fixes: - Sanitise the body in the poster: break bare @handles, drop raw HTML. - Drop the Verdict: line, or set it from the severities you already count, not from the model's word. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
