--model value not quoted in claude_args assembly — benign now but fragile if charset ever widens #144

Non-Blocking Review Concern: --model value not quoted in claude_args assembly — benign now but fragile if charset ever widens

Source: pre-push whole-codebase review
Location: .github/workflows/claude-assistant.yml:178
Date: 2026-08-17

What was flagged

CLAUDE_ARGS="--model $MODEL" emits the model name without quoting. Currently safe because the validation regex [a-zA-Z0-9._-]+ excludes all whitespace and shell-special characters, so there's no injection path. But the assembled string is later passed as a step output and expanded unquoted in the YAML claude_args: ${{ steps.args.outputs.claude_args }} value. If the charset validation were ever relaxed (e.g., to allow / for a hypothetical model path), the unquoted $MODEL would word-split. Low risk as written, but defensive quoting (CLAUDE_ARGS="--model \"$MODEL\"") would make this immune to future charset drift.

Context

This issue was automatically created from a non-blocking concern identified
during pre-push whole-codebase review. It was flagged for tracking.

Created by lib-review-issues.sh