ci: security review: give more permissions to claude
What the developer wrote
Authored by f321x
ci: security review: give more permissions to claude
With `--dangerously-skip-permissions` claude can also execute
commands. I thought the `-p` flag for headless usage already
did that, but apparently not
(looking at https://code.claude.com/docs/en/headless).
As it runs in the isolated CI container this seems fine and
might make it more powerful (e.g. allowing it to run and
modify unittests to verify behavior).
What changed, and why it matters
This commit changes Electrum's automated CI security-review bot so that the Claude AI assistant is allowed to run shell commands and modify files on its own, rather than only answering questions. The change is intentional and runs inside an isolated CI container under a non-root user. It is a tooling/configuration change, not a fix for a vulnerability in Electrum wallet software itself.
Treat this as a CI hardening/configuration review, not as a security patch. Verify that the Cirrus CI container is indeed isolated, ephemeral, and has no access to production secrets, signing keys, or external deploy credentials. Confirm the `node` user has minimal filesystem permissions and that the Claude API token is scoped only to this job. Consider documenting the risk acceptance for granting an AI agent unsupervised command execution.
Security signals we found
New command-line flag named `--dangerously-skip-permissions` introduced
CI script now permits an AI agent to execute commands and modify files without interactive permission checks
Execution context changed from root to unprivileged `node` user to satisfy Claude's refusal to run as root
Change is self-described as a CI security-review tooling enhancement, not a product vulnerability fix
Evidence from the diff
The patch adds --dangerously-skip-permissions to the claude invocation in contrib/ci/claude_security_review.py and switches the Cirrus CI task from running as root to running as a node user. The flag removes Claude Code’s permission prompts, enabling the agent to execute commands and edit files headlessly. The commit message explicitly states this is intentional, isolated, and aimed at making the security review more powerful (e.g., running/modifying unit tests).
Changed components
.cirrus.ymlcontrib/ci/claude_security_review.pyCirrus CI nightly security-review jobInspect captured patch +4 / −1
diff --git a/.cirrus.yml b/.cirrus.yml
index 976d573..aef2e79 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -264,7 +264,9 @@ task:
install_script:
- npm install -g @anthropic-ai/claude-code
review_script:
- - python3 contrib/ci/claude_security_review.py
+ # the script is executed as 'node' user as claude refuses to run with root permissions
+ - chown -R node:node .
+ - su node -c "python3 contrib/ci/claude_security_review.py"
# Cron jobs configured in https://cirrus-ci.com/settings/...
# - job "nightly" on branch "master" at "0 30 2 * * ?" (every day at 02:30Z)
diff --git a/contrib/ci/claude_security_review.py b/contrib/ci/claude_security_review.py
index ea1de7e..7324bff 100755
--- a/contrib/ci/claude_security_review.py
+++ b/contrib/ci/claude_security_review.py
@@ -101,6 +101,7 @@ def run_claude(prompt: str) -> str | None:
cmd = [
"claude",
"-p",
+ "--dangerously-skip-permissions",
"--model", CLAUDE_MODEL,
"--effort", CLAUDE_EFFORT,
"--output-format", "text",
Why this scored 20/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.