SD-016 — CLAUDE.md Comment-and-Control

An instruction file directing the agent to treat pull-request comments, issue bodies, or the URLs in them as authoritative — to execute them, or to act without asking.

Those channels are open to anyone who can comment on the repository, which on a public project is everyone. An instruction to obey them turns a comment box into a remote-command interface with the agent's full tool access: whoever writes the comment chooses what the agent does, using the maintainer's checkout, credentials and CI. The instruction is committed, so it governs every future run, and the person driving it never needs write access to the repository at all.

Remove the instruction. Comments, issue bodies and fetched pages are untrusted input: the file should say the agent may read and summarise them, and that acting on them needs a human decision. Where automation is genuinely wanted, gate it on something only a maintainer controls — a label, an approving review — never on the text of a comment.

A repository whose automation is genuinely meant to act on issue and comment text, where the instruction is deliberate and the inputs are trusted.

Pattern SD-016 was detected in 0 of 16475 public skills scanned as of 11 September 2026.