Scan agent config before it runs

Hooks, MCP declarations, instruction files, and editor tasks are checked into the repository but are not dependencies or application source. Many scanners do not read them.

How the August 2026 npm worm persisted

Dependency tooling found the poisoned package versions. The payload also wrote files under .claude/settings.json, .claude/setup.mjs, .vscode/tasks.json, and .vscode/setup.mjs, and used stolen credentials to commit them to other repositories.

Removing the package or regenerating the lockfile does not remove those files. Opening the folder in an editor or agent can run them again.

What that looks like in a scan

10 agent-config rules

• agent-config-env-redirect high Repository config redirects the agent's API traffic
• agent-config-loader-script high Executable script inside an agent or editor config directory
• agent-config-secret-reachable high Repository config puts credentials in reach of a repository-controlled command
• agent-hook-autoexec high Repository config executes a command when the workspace is opened
• agent-hook-untrusted-command high Hook command reaches outside the project
• agent-instructions-directive medium Instruction file tells the agent to bypass its own controls
• agent-instructions-hidden-text high Instruction file contains text a human reader cannot see
• agent-marketplace-untrusted medium Repository config adds a third-party plugin or skill source
• agent-mcp-unpinned-remote medium MCP server declaration resolves code at run time
• agent-permission-wildcard medium Repository config pre-approves a broad tool permission

Which files are in scope

owlwarden scans a fixed list of paths at the repository root and below package directories. It does not scan agent config inside node_modules.

.claude/settings.json          .cursor/mcp.json           .vscode/tasks.json
.claude/settings.local.json    .cursor/hooks.json         .vscode/settings.json
.claude/hooks/**               .cursor/hooks/**           .vscode/extensions.json
.claude/agents/**              .cursor/rules/**           .vscode/*.{js,mjs,ts,sh,py}
.claude/skills/**              .cursorrules               .devcontainer/devcontainer.json
.claude/*.{js,mjs,ts,sh,py}    .gemini/**                 .github/copilot-instructions.md
.claude-plugin/**              .codex/**                  .mcp.json  mcp.json
CLAUDE.md                      AGENTS.md

.claude/settings.local.json is conventionally gitignored. It is also used for workspace hooks, so agent-config scans include it even when it is ignored. Path containment, symlink checks, and size limits still apply.

Check your own repository

npx owlwarden scan --preset agent-surface   # your own repo
npx owlwarden vet ./cloned-repo             # someone else's

vet is the one to use on a repository you did not write. It ignores target policy and reports target suppressions. The ASI table shows the category mapping.

Keep reading

• owlwarden turnWhich of these did I just do?
• RulesTrigger, confidence, and framework-specific fix.
• Agent configHooks, MCP servers, instructions, and editor tasks.
• owlwarden vetCheck a repository before you open it.
• owlwarden sealNotice when your agent's execution surface moves.
• ExposureWhich of these findings do I fix first?
• RuntimesDoes this fix run on Bun, Deno, or Workers?
• CoverageMapped rules and categories static analysis cannot cover.