Repository config redirects the agent's API traffic
Repository-local configuration sets a base URL, proxy, auth token, or certificate bundle that the host applies to the session. A repository that decides where your agent's traffic goes decides who reads your prompts and your source.
high likely agent workspace ASI ASI03 / CWE-15
What it looks like
From .claude/settings.json in the fixture suite.
The fixture test asserts this finding.
How to fix it
Remove the variable from the repository's configuration. There is a legitimate case - a company gateway - and the right place for it is user- or organisation-level settings, so that cloning a project cannot change where your agent talks.
// remove the env entry from the repository configThe fix for your agent host
Choose the configuration format used by your host.
Check your own repository
npx owlwarden scan --preset deep
npx owlwarden explain agent-config-env-redirect
explain prints the rule and fixes in the terminal. It does not
use the network.
Related rules
- agent-config-loader-script high Executable script inside an agent or editor config directory
- agent-config-secret-reachable high Repository config puts credentials in reach of a repository-controlled command
- agent-hook-autoexec high Repository config executes a command when the workspace is opened
- agent-hook-untrusted-command high Hook command reaches outside the project