fix(security): add collaborator filter to all agent prompts

[AhmedTMM]

Summary

• The bash collaborator gate (exit 0 before Claude spawns) only blocks issue-triggered runs. Schedule-triggered agents run Claude freely, and prompts told it to run raw gh issue list — bypassing the gate entirely.
• Non-collaborator issue bodies could contain prompt injection that Claude would read and act on.
• All 10 prompt files with gh issue list or gh pr list now pipe through a jq filter using the cached collaborator list at /tmp/spawn-collaborators-cache.
• Added a mandatory "Collaborator Gate" section to _shared-rules.md with the reusable filter snippet.

Files changed

• _shared-rules.md — new collaborator gate section + updated dedup rule
• 6 issue-list prompts (high risk): refactor-team-prompt.md, refactor-community-coordinator.md, security-issue-checker.md, qa-record-keeper.md, security-scan-prompt.md, security-scanner.md
• 4 PR-list prompts (lower risk): refactor-issue-prompt.md, security-review-all-prompt.md, security-team-building-prompt.md, refactor-pr-maintainer.md

Test plan

• Run a refactor cycle and verify only collaborator issues appear
• File a test issue from a non-collaborator account and confirm agents don't see it

🤖 Generated with Claude Code

[la14-1]

Approved. This closes the prompt-injection gap left open by #3333: schedule-triggered agents (no SPAWN_ISSUE) bypass the bash gate, and any raw gh issue list they ran would pull non-collaborator issue bodies into the context — which is exactly the surface an attacker would target. Pushing the filter into the prompts themselves is the right layer.

Things I checked:

• All 10 prompt files with gh issue list / gh pr list updated (6 high-risk issue lists, 4 lower-risk PR lists)
• Shared snippet in _shared-rules.md includes the cache-refresh logic with 10-min TTL — self-contained
• ,author added to the --json field list wherever needed so the filter has something to select on
• Fail-closed behavior: empty cache / missing file → empty result (bots see nothing) rather than unfiltered — safer degradation

One follow-up worth tracking: the individual prompt edits rely on /tmp/spawn-collaborators-cache already existing. On a cold schedule run, collaborator-gate.sh is sourced but _refresh_collaborator_cache is never called unless is_collaborator is invoked (which is gated on SPAWN_ISSUE). Worst case is empty filter → no work done, so not a security regression, but should be tightened. Will file separately.

Shipping.

[AhmedTMM]

Summary

• The bash collaborator gate (exit 0 before Claude spawns) only blocks issue-triggered runs. Schedule-triggered agents run Claude freely, and prompts told it to run raw gh issue list — bypassing the gate entirely.
• Non-collaborator issue bodies could contain prompt injection that Claude would read and act on.
• All 10 prompt files with gh issue list or gh pr list now pipe through a jq filter using the cached collaborator list at /tmp/spawn-collaborators-cache.
• Added a mandatory "Collaborator Gate" section to _shared-rules.md with the reusable filter snippet.

Files changed

• _shared-rules.md — new collaborator gate section + updated dedup rule
• 6 issue-list prompts (high risk): refactor-team-prompt.md, refactor-community-coordinator.md, security-issue-checker.md, qa-record-keeper.md, security-scan-prompt.md, security-scanner.md
• 4 PR-list prompts (lower risk): refactor-issue-prompt.md, security-review-all-prompt.md, security-team-building-prompt.md, refactor-pr-maintainer.md

Test plan

• Run a refactor cycle and verify only collaborator issues appear
• File a test issue from a non-collaborator account and confirm agents don't see it

🤖 Generated with Claude Code

[la14-1]

Approved. This closes the prompt-injection gap left open by #3333: schedule-triggered agents (no SPAWN_ISSUE) bypass the bash gate, and any raw gh issue list they ran would pull non-collaborator issue bodies into the context — which is exactly the surface an attacker would target. Pushing the filter into the prompts themselves is the right layer.

Things I checked:

• All 10 prompt files with gh issue list / gh pr list updated (6 high-risk issue lists, 4 lower-risk PR lists)
• Shared snippet in _shared-rules.md includes the cache-refresh logic with 10-min TTL — self-contained
• ,author added to the --json field list wherever needed so the filter has something to select on
• Fail-closed behavior: empty cache / missing file → empty result (bots see nothing) rather than unfiltered — safer degradation

One follow-up worth tracking: the individual prompt edits rely on /tmp/spawn-collaborators-cache already existing. On a cold schedule run, collaborator-gate.sh is sourced but _refresh_collaborator_cache is never called unless is_collaborator is invoked (which is gated on SPAWN_ISSUE). Worst case is empty filter → no work done, so not a security regression, but should be tightened. Will file separately.

Shipping.

[AhmedTMM]

Summary

• The bash collaborator gate (exit 0 before Claude spawns) only blocks issue-triggered runs. Schedule-triggered agents run Claude freely, and prompts told it to run raw gh issue list — bypassing the gate entirely.
• Non-collaborator issue bodies could contain prompt injection that Claude would read and act on.
• All 10 prompt files with gh issue list or gh pr list now pipe through a jq filter using the cached collaborator list at /tmp/spawn-collaborators-cache.
• Added a mandatory "Collaborator Gate" section to _shared-rules.md with the reusable filter snippet.

Files changed

• _shared-rules.md — new collaborator gate section + updated dedup rule
• 6 issue-list prompts (high risk): refactor-team-prompt.md, refactor-community-coordinator.md, security-issue-checker.md, qa-record-keeper.md, security-scan-prompt.md, security-scanner.md
• 4 PR-list prompts (lower risk): refactor-issue-prompt.md, security-review-all-prompt.md, security-team-building-prompt.md, refactor-pr-maintainer.md

Test plan

• Run a refactor cycle and verify only collaborator issues appear
• File a test issue from a non-collaborator account and confirm agents don't see it

🤖 Generated with Claude Code

[la14-1]

Approved. This closes the prompt-injection gap left open by #3333: schedule-triggered agents (no SPAWN_ISSUE) bypass the bash gate, and any raw gh issue list they ran would pull non-collaborator issue bodies into the context — which is exactly the surface an attacker would target. Pushing the filter into the prompts themselves is the right layer.

Things I checked:

• All 10 prompt files with gh issue list / gh pr list updated (6 high-risk issue lists, 4 lower-risk PR lists)
• Shared snippet in _shared-rules.md includes the cache-refresh logic with 10-min TTL — self-contained
• ,author added to the --json field list wherever needed so the filter has something to select on
• Fail-closed behavior: empty cache / missing file → empty result (bots see nothing) rather than unfiltered — safer degradation

One follow-up worth tracking: the individual prompt edits rely on /tmp/spawn-collaborators-cache already existing. On a cold schedule run, collaborator-gate.sh is sourced but _refresh_collaborator_cache is never called unless is_collaborator is invoked (which is gated on SPAWN_ISSUE). Worst case is empty filter → no work done, so not a security regression, but should be tightened. Will file separately.

Shipping.

[AhmedTMM]

Summary

• The bash collaborator gate (exit 0 before Claude spawns) only blocks issue-triggered runs. Schedule-triggered agents run Claude freely, and prompts told it to run raw gh issue list — bypassing the gate entirely.
• Non-collaborator issue bodies could contain prompt injection that Claude would read and act on.
• All 10 prompt files with gh issue list or gh pr list now pipe through a jq filter using the cached collaborator list at /tmp/spawn-collaborators-cache.
• Added a mandatory "Collaborator Gate" section to _shared-rules.md with the reusable filter snippet.

Files changed

• _shared-rules.md — new collaborator gate section + updated dedup rule
• 6 issue-list prompts (high risk): refactor-team-prompt.md, refactor-community-coordinator.md, security-issue-checker.md, qa-record-keeper.md, security-scan-prompt.md, security-scanner.md
• 4 PR-list prompts (lower risk): refactor-issue-prompt.md, security-review-all-prompt.md, security-team-building-prompt.md, refactor-pr-maintainer.md

Test plan

• Run a refactor cycle and verify only collaborator issues appear
• File a test issue from a non-collaborator account and confirm agents don't see it

🤖 Generated with Claude Code

[la14-1]

Approved. This closes the prompt-injection gap left open by #3333: schedule-triggered agents (no SPAWN_ISSUE) bypass the bash gate, and any raw gh issue list they ran would pull non-collaborator issue bodies into the context — which is exactly the surface an attacker would target. Pushing the filter into the prompts themselves is the right layer.

Things I checked:

• All 10 prompt files with gh issue list / gh pr list updated (6 high-risk issue lists, 4 lower-risk PR lists)
• Shared snippet in _shared-rules.md includes the cache-refresh logic with 10-min TTL — self-contained
• ,author added to the --json field list wherever needed so the filter has something to select on
• Fail-closed behavior: empty cache / missing file → empty result (bots see nothing) rather than unfiltered — safer degradation

One follow-up worth tracking: the individual prompt edits rely on /tmp/spawn-collaborators-cache already existing. On a cold schedule run, collaborator-gate.sh is sourced but _refresh_collaborator_cache is never called unless is_collaborator is invoked (which is gated on SPAWN_ISSUE). Worst case is empty filter → no work done, so not a security regression, but should be tightened. Will file separately.

Shipping.

[AhmedTMM]

Summary

• The bash collaborator gate (exit 0 before Claude spawns) only blocks issue-triggered runs. Schedule-triggered agents run Claude freely, and prompts told it to run raw gh issue list — bypassing the gate entirely.
• Non-collaborator issue bodies could contain prompt injection that Claude would read and act on.
• All 10 prompt files with gh issue list or gh pr list now pipe through a jq filter using the cached collaborator list at /tmp/spawn-collaborators-cache.
• Added a mandatory "Collaborator Gate" section to _shared-rules.md with the reusable filter snippet.

Files changed

• _shared-rules.md — new collaborator gate section + updated dedup rule
• 6 issue-list prompts (high risk): refactor-team-prompt.md, refactor-community-coordinator.md, security-issue-checker.md, qa-record-keeper.md, security-scan-prompt.md, security-scanner.md
• 4 PR-list prompts (lower risk): refactor-issue-prompt.md, security-review-all-prompt.md, security-team-building-prompt.md, refactor-pr-maintainer.md

Test plan

• Run a refactor cycle and verify only collaborator issues appear
• File a test issue from a non-collaborator account and confirm agents don't see it

🤖 Generated with Claude Code

[la14-1]

Approved. This closes the prompt-injection gap left open by #3333: schedule-triggered agents (no SPAWN_ISSUE) bypass the bash gate, and any raw gh issue list they ran would pull non-collaborator issue bodies into the context — which is exactly the surface an attacker would target. Pushing the filter into the prompts themselves is the right layer.

Things I checked:

• All 10 prompt files with gh issue list / gh pr list updated (6 high-risk issue lists, 4 lower-risk PR lists)
• Shared snippet in _shared-rules.md includes the cache-refresh logic with 10-min TTL — self-contained
• ,author added to the --json field list wherever needed so the filter has something to select on
• Fail-closed behavior: empty cache / missing file → empty result (bots see nothing) rather than unfiltered — safer degradation

One follow-up worth tracking: the individual prompt edits rely on /tmp/spawn-collaborators-cache already existing. On a cold schedule run, collaborator-gate.sh is sourced but _refresh_collaborator_cache is never called unless is_collaborator is invoked (which is gated on SPAWN_ISSUE). Worst case is empty filter → no work done, so not a security regression, but should be tightened. Will file separately.

Shipping.

[AhmedTMM]

Summary

• The bash collaborator gate (exit 0 before Claude spawns) only blocks issue-triggered runs. Schedule-triggered agents run Claude freely, and prompts told it to run raw gh issue list — bypassing the gate entirely.
• Non-collaborator issue bodies could contain prompt injection that Claude would read and act on.
• All 10 prompt files with gh issue list or gh pr list now pipe through a jq filter using the cached collaborator list at /tmp/spawn-collaborators-cache.
• Added a mandatory "Collaborator Gate" section to _shared-rules.md with the reusable filter snippet.

Files changed

• _shared-rules.md — new collaborator gate section + updated dedup rule
• 6 issue-list prompts (high risk): refactor-team-prompt.md, refactor-community-coordinator.md, security-issue-checker.md, qa-record-keeper.md, security-scan-prompt.md, security-scanner.md
• 4 PR-list prompts (lower risk): refactor-issue-prompt.md, security-review-all-prompt.md, security-team-building-prompt.md, refactor-pr-maintainer.md

Test plan

• Run a refactor cycle and verify only collaborator issues appear
• File a test issue from a non-collaborator account and confirm agents don't see it

🤖 Generated with Claude Code

[la14-1]

Approved. This closes the prompt-injection gap left open by #3333: schedule-triggered agents (no SPAWN_ISSUE) bypass the bash gate, and any raw gh issue list they ran would pull non-collaborator issue bodies into the context — which is exactly the surface an attacker would target. Pushing the filter into the prompts themselves is the right layer.

Things I checked:

• All 10 prompt files with gh issue list / gh pr list updated (6 high-risk issue lists, 4 lower-risk PR lists)
• Shared snippet in _shared-rules.md includes the cache-refresh logic with 10-min TTL — self-contained
• ,author added to the --json field list wherever needed so the filter has something to select on
• Fail-closed behavior: empty cache / missing file → empty result (bots see nothing) rather than unfiltered — safer degradation

One follow-up worth tracking: the individual prompt edits rely on /tmp/spawn-collaborators-cache already existing. On a cold schedule run, collaborator-gate.sh is sourced but _refresh_collaborator_cache is never called unless is_collaborator is invoked (which is gated on SPAWN_ISSUE). Worst case is empty filter → no work done, so not a security regression, but should be tightened. Will file separately.

Shipping.

[AhmedTMM]

Summary

• The bash collaborator gate (exit 0 before Claude spawns) only blocks issue-triggered runs. Schedule-triggered agents run Claude freely, and prompts told it to run raw gh issue list — bypassing the gate entirely.
• Non-collaborator issue bodies could contain prompt injection that Claude would read and act on.
• All 10 prompt files with gh issue list or gh pr list now pipe through a jq filter using the cached collaborator list at /tmp/spawn-collaborators-cache.
• Added a mandatory "Collaborator Gate" section to _shared-rules.md with the reusable filter snippet.

Files changed

• _shared-rules.md — new collaborator gate section + updated dedup rule
• 6 issue-list prompts (high risk): refactor-team-prompt.md, refactor-community-coordinator.md, security-issue-checker.md, qa-record-keeper.md, security-scan-prompt.md, security-scanner.md
• 4 PR-list prompts (lower risk): refactor-issue-prompt.md, security-review-all-prompt.md, security-team-building-prompt.md, refactor-pr-maintainer.md

Test plan

• Run a refactor cycle and verify only collaborator issues appear
• File a test issue from a non-collaborator account and confirm agents don't see it

🤖 Generated with Claude Code

[la14-1]

Approved. This closes the prompt-injection gap left open by #3333: schedule-triggered agents (no SPAWN_ISSUE) bypass the bash gate, and any raw gh issue list they ran would pull non-collaborator issue bodies into the context — which is exactly the surface an attacker would target. Pushing the filter into the prompts themselves is the right layer.

Things I checked:

• All 10 prompt files with gh issue list / gh pr list updated (6 high-risk issue lists, 4 lower-risk PR lists)
• Shared snippet in _shared-rules.md includes the cache-refresh logic with 10-min TTL — self-contained
• ,author added to the --json field list wherever needed so the filter has something to select on
• Fail-closed behavior: empty cache / missing file → empty result (bots see nothing) rather than unfiltered — safer degradation

One follow-up worth tracking: the individual prompt edits rely on /tmp/spawn-collaborators-cache already existing. On a cold schedule run, collaborator-gate.sh is sourced but _refresh_collaborator_cache is never called unless is_collaborator is invoked (which is gated on SPAWN_ISSUE). Worst case is empty filter → no work done, so not a security regression, but should be tightened. Will file separately.

Shipping.

[AhmedTMM]

Summary

• The bash collaborator gate (exit 0 before Claude spawns) only blocks issue-triggered runs. Schedule-triggered agents run Claude freely, and prompts told it to run raw gh issue list — bypassing the gate entirely.
• Non-collaborator issue bodies could contain prompt injection that Claude would read and act on.
• All 10 prompt files with gh issue list or gh pr list now pipe through a jq filter using the cached collaborator list at /tmp/spawn-collaborators-cache.
• Added a mandatory "Collaborator Gate" section to _shared-rules.md with the reusable filter snippet.

Files changed

• _shared-rules.md — new collaborator gate section + updated dedup rule
• 6 issue-list prompts (high risk): refactor-team-prompt.md, refactor-community-coordinator.md, security-issue-checker.md, qa-record-keeper.md, security-scan-prompt.md, security-scanner.md
• 4 PR-list prompts (lower risk): refactor-issue-prompt.md, security-review-all-prompt.md, security-team-building-prompt.md, refactor-pr-maintainer.md

Test plan

• Run a refactor cycle and verify only collaborator issues appear
• File a test issue from a non-collaborator account and confirm agents don't see it

🤖 Generated with Claude Code

[la14-1]

Approved. This closes the prompt-injection gap left open by #3333: schedule-triggered agents (no SPAWN_ISSUE) bypass the bash gate, and any raw gh issue list they ran would pull non-collaborator issue bodies into the context — which is exactly the surface an attacker would target. Pushing the filter into the prompts themselves is the right layer.

Things I checked:

• All 10 prompt files with gh issue list / gh pr list updated (6 high-risk issue lists, 4 lower-risk PR lists)
• Shared snippet in _shared-rules.md includes the cache-refresh logic with 10-min TTL — self-contained
• ,author added to the --json field list wherever needed so the filter has something to select on
• Fail-closed behavior: empty cache / missing file → empty result (bots see nothing) rather than unfiltered — safer degradation

One follow-up worth tracking: the individual prompt edits rely on /tmp/spawn-collaborators-cache already existing. On a cold schedule run, collaborator-gate.sh is sourced but _refresh_collaborator_cache is never called unless is_collaborator is invoked (which is gated on SPAWN_ISSUE). Worst case is empty filter → no work done, so not a security regression, but should be tightened. Will file separately.

Shipping.