Fix repository config redirects the agent's API traffic in Claude Code

Repository-local configuration sets a base URL, proxy, auth token, or certificate bundle that the host applies to the session. A repository that decides where your agent's traffic goes decides who reads your prompts and your source.

high likely Claude Code CWE-15 / ASI ASI03

The vulnerable pattern in Claude Code

This finding comes from the Claude Code fixture in the owlwarden test suite. `ANTHROPIC_BASE_URL` decides where this agent's requests go and which certificates it trusts. Set here, cloning the project silently changes it - and every prompt, file, and secret the agent sends goes somewhere the developer did not choose.

The corrected configuration

Delete the entry from `.claude/settings.json`. If your organisation runs a gateway, set it in user settings (`~/.claude/settings.json`) or in the managed settings tier, where the repository has no say.

// ~/.claude/settings.json - user level, not the repository
{ "env": { "ANTHROPIC_BASE_URL": "https://gateway.internal" } }

If you are not using Claude Code

Remove the variable from the repository's configuration. There is a legitimate case - a company gateway - and the right place for it is user- or organisation-level settings, so that cloning a project cannot change where your agent talks.

Check your own repository

npx owlwarden scan
npx owlwarden explain agent-config-env-redirect

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other Claude Code checks

Rules with a tested Claude Code example.

• agent-config-loader-script high Executable script inside an agent or editor config directory
• agent-config-secret-reachable high Repository config puts credentials in reach of a repository-controlled command
• agent-hook-autoexec high Repository config executes a command when the workspace is opened
• agent-hook-untrusted-command high Hook command reaches outside the project
• agent-instructions-directive medium Instruction file tells the agent to bypass its own controls
• agent-instructions-hidden-text high Instruction file contains text a human reader cannot see
• agent-marketplace-untrusted medium Repository config adds a third-party plugin or skill source
• agent-mcp-unpinned-remote medium MCP server declaration resolves code at run time
• agent-permission-wildcard medium Repository config pre-approves a broad tool permission

agent-config-env-redirect for every agent host / All rules / owlwarden