From 04ce8c9660fc0bb4b96a0f4bcd0974b132d1d947 Mon Sep 17 00:00:00 2001 From: "claude[bot]" Date: Wed, 22 Apr 2026 00:34:55 +0000 Subject: [PATCH] fix: quote \$ARGUMENTS in shell invocations Unquoted \$ARGUMENTS in shell contexts is a word-splitting risk: if the AI constructs input containing spaces or shell metacharacters, the shell expands it into multiple tokens rather than treating it as a single argument, which can bypass tool restrictions or inject extra flags. - pr-review.md: gh pr view/diff "\$ARGUMENTS" - code-quality.md: npm run lint -- "\$ARGUMENTS" Co-Authored-By: Claude Code --- .claude/commands/code-quality.md | 2 +- .claude/commands/pr-review.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.claude/commands/code-quality.md b/.claude/commands/code-quality.md index 6e4aacc..efce0c9 100644 --- a/.claude/commands/code-quality.md +++ b/.claude/commands/code-quality.md @@ -15,7 +15,7 @@ Review code quality in: $ARGUMENTS 2. **Run automated checks**: ```bash - npm run lint -- $ARGUMENTS + npm run lint -- "$ARGUMENTS" npm run typecheck ``` diff --git a/.claude/commands/pr-review.md b/.claude/commands/pr-review.md index a81739d..2a1951b 100644 --- a/.claude/commands/pr-review.md +++ b/.claude/commands/pr-review.md @@ -10,8 +10,8 @@ Review the pull request: $ARGUMENTS ## Instructions 1. **Get PR information**: - - Run `gh pr view $ARGUMENTS` to get PR details - - Run `gh pr diff $ARGUMENTS` to see changes + - Run `gh pr view "$ARGUMENTS"` to get PR details + - Run `gh pr diff "$ARGUMENTS"` to see changes 2. **Read review standards**: - Read `.claude/agents/code-reviewer.md` for the review checklist