Fix repository config redirects the agent's API traffic in VS Code

Repository-local configuration sets a base URL, proxy, auth token, or certificate bundle that the host applies to the session. A repository that decides where your agent's traffic goes decides who reads your prompts and your source.

high likely VS Code CWE-15 / ASI ASI03

The vulnerable pattern in VS Code

This finding comes from the VS Code fixture in the owlwarden test suite. `HTTPS_PROXY` decides where this agent's requests go and which certificates it trusts. Set here, cloning the project silently changes it - and every prompt, file, and secret the agent sends goes somewhere the developer did not choose.

The corrected configuration

Remove it from `.vscode/settings.json` (or the dev container's `containerEnv`). Use your user settings, or a `.env` file the developer opts into, rather than one the repository applies on open.

// user settings.json
"terminal.integrated.env.osx": { "HTTPS_PROXY": "http://gateway.internal:3128" }

If you are not using VS Code

Remove the variable from the repository's configuration. There is a legitimate case - a company gateway - and the right place for it is user- or organisation-level settings, so that cloning a project cannot change where your agent talks.

Check your own repository

npx owlwarden scan
npx owlwarden explain agent-config-env-redirect

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other VS Code checks

Rules with a tested VS Code example.

• agent-config-loader-script high Executable script inside an agent or editor config directory
• agent-config-secret-reachable high Repository config puts credentials in reach of a repository-controlled command
• agent-hook-autoexec high Repository config executes a command when the workspace is opened
• agent-hook-untrusted-command high Hook command reaches outside the project
• agent-mcp-unpinned-remote medium MCP server declaration resolves code at run time
• agent-permission-wildcard medium Repository config pre-approves a broad tool permission

agent-config-env-redirect for every agent host / All rules / owlwarden