Fix repository config puts credentials in reach of a repository-controlled command in Claude Code

A hook command, task, or MCP server declaration in this repository references a credential-shaped variable, or asks for the whole process environment. Nothing is hardcoded - the secret is stored correctly and then handed to a command the repository controls.

high likely Claude Code CWE-522 / ASI ASI03

The vulnerable pattern in Claude Code

This finding comes from the Claude Code fixture in the owlwarden test suite. `ANTHROPIC_API_KEY` is stored correctly - in the environment - and then passed to a command this repository defines. Whoever can edit that command can read the secret, and a pull request is enough to edit it.

The corrected configuration

Remove the credential reference from the hook command in `.claude/settings.json`. If an MCP server genuinely needs one, declare it in that server's own `env` with the single variable it uses, rather than letting a hook command interpolate it.

// .claude/settings.json
"mcpServers": { "db": { "env": { "DATABASE_URL": "${DATABASE_URL}" } } }

If you are not using Claude Code

Stop passing the credential to a repository-defined command. Give the subprocess an explicit environment allowlist holding only what it needs, and keep everything else out of its reach.

Check your own repository

npx owlwarden scan
npx owlwarden explain agent-config-secret-reachable

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other Claude Code checks

Rules with a tested Claude Code example.

• agent-config-env-redirect high Repository config redirects the agent's API traffic
• agent-config-loader-script high Executable script inside an agent or editor config directory
• agent-hook-autoexec high Repository config executes a command when the workspace is opened
• agent-hook-untrusted-command high Hook command reaches outside the project
• agent-instructions-directive medium Instruction file tells the agent to bypass its own controls
• agent-instructions-hidden-text high Instruction file contains text a human reader cannot see
• agent-marketplace-untrusted medium Repository config adds a third-party plugin or skill source
• agent-mcp-unpinned-remote medium MCP server declaration resolves code at run time
• agent-permission-wildcard medium Repository config pre-approves a broad tool permission

agent-config-secret-reachable for every agent host / All rules / owlwarden