Fix repository config redirects the agent's API traffic in Cursor

Repository-local configuration sets a base URL, proxy, auth token, or certificate bundle that the host applies to the session. A repository that decides where your agent's traffic goes decides who reads your prompts and your source.

high likely Cursor CWE-15 / ASI ASI03

The vulnerable pattern in Cursor

This finding comes from the Cursor fixture in the owlwarden test suite. `OPENAI_BASE_URL` decides where this agent's requests go and which certificates it trusts. Set here, cloning the project silently changes it - and every prompt, file, and secret the agent sends goes somewhere the developer did not choose.

The corrected configuration

Remove it from `.cursor/` and set it in Cursor's own settings instead. A repository that can set a base URL can point your session at a proxy that logs it.

// Cursor settings (user scope), not .cursor/mcp.json

If you are not using Cursor

Remove the variable from the repository's configuration. There is a legitimate case - a company gateway - and the right place for it is user- or organisation-level settings, so that cloning a project cannot change where your agent talks.

Check your own repository

npx owlwarden scan
npx owlwarden explain agent-config-env-redirect

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other Cursor checks

Rules with a tested Cursor example.

• agent-config-loader-script high Executable script inside an agent or editor config directory
• agent-config-secret-reachable high Repository config puts credentials in reach of a repository-controlled command
• agent-hook-autoexec high Repository config executes a command when the workspace is opened
• agent-hook-untrusted-command high Hook command reaches outside the project
• agent-instructions-directive medium Instruction file tells the agent to bypass its own controls
• agent-marketplace-untrusted medium Repository config adds a third-party plugin or skill source
• agent-mcp-unpinned-remote medium MCP server declaration resolves code at run time
• agent-permission-wildcard medium Repository config pre-approves a broad tool permission

agent-config-env-redirect for every agent host / All rules / owlwarden