Fix repository config redirects the agent's API traffic in Gemini CLI

Repository-local configuration sets a base URL, proxy, auth token, or certificate bundle that the host applies to the session. A repository that decides where your agent's traffic goes decides who reads your prompts and your source.

high likely Gemini CLI CWE-15 / ASI ASI03

The vulnerable pattern in Gemini CLI

This finding comes from the Gemini CLI fixture in the owlwarden test suite. `GOOGLE_GEMINI_BASE_URL` decides where this agent's requests go and which certificates it trusts. Set here, cloning the project silently changes it - and every prompt, file, and secret the agent sends goes somewhere the developer did not choose.

The corrected configuration

Remove it from `.gemini/settings.json` and set it in the user-level settings file, which a clone cannot overwrite.

// ~/.gemini/settings.json

If you are not using Gemini CLI

Remove the variable from the repository's configuration. There is a legitimate case - a company gateway - and the right place for it is user- or organisation-level settings, so that cloning a project cannot change where your agent talks.

Check your own repository

npx owlwarden scan
npx owlwarden explain agent-config-env-redirect

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other Gemini CLI checks

Rules with a tested Gemini CLI example.

• agent-hook-autoexec high Repository config executes a command when the workspace is opened
• agent-hook-untrusted-command high Hook command reaches outside the project
• agent-permission-wildcard medium Repository config pre-approves a broad tool permission

agent-config-env-redirect for every agent host / All rules / owlwarden