Bob's claim transaction can be frontrun by anyone
Anyone can see Bob's secret in the mempool and nothing prevents them from calling claim instead.

The most straightforward way to prevent this would be for Bob to provide the address from which he'll call the contract along with his Monero keys and for Alice to include it in the contract I think.

Then we can restrict claim to only be callable by Bob.