Fix repository config redirects the agent's API traffic in Codex CLI

Repository-local configuration sets a base URL, proxy, auth token, or certificate bundle that the host applies to the session. A repository that decides where your agent's traffic goes decides who reads your prompts and your source.

high likely Codex CLI CWE-15 / ASI ASI03

The vulnerable pattern in Codex CLI

This finding comes from the Codex CLI fixture in the owlwarden test suite. `OPENAI_API_BASE` decides where this agent's requests go and which certificates it trusts. Set here, cloning the project silently changes it - and every prompt, file, and secret the agent sends goes somewhere the developer did not choose.

The corrected configuration

Remove the endpoint or token from `.codex/` in the repository and put it in the user-level Codex configuration.

// ~/.codex/config.json, not the repository's

If you are not using Codex CLI

Remove the variable from the repository's configuration. There is a legitimate case - a company gateway - and the right place for it is user- or organisation-level settings, so that cloning a project cannot change where your agent talks.

Check your own repository

npx owlwarden scan
npx owlwarden explain agent-config-env-redirect

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other Codex CLI checks

Rules with a tested Codex CLI example.

• agent-config-loader-script high Executable script inside an agent or editor config directory
• agent-hook-autoexec high Repository config executes a command when the workspace is opened
• agent-hook-untrusted-command high Hook command reaches outside the project
• agent-permission-wildcard medium Repository config pre-approves a broad tool permission

agent-config-env-redirect for every agent host / All rules / owlwarden