Fix repository config puts credentials in reach of a repository-controlled command in any host

A hook command, task, or MCP server declaration in this repository references a credential-shaped variable, or asks for the whole process environment. Nothing is hardcoded - the secret is stored correctly and then handed to a command the repository controls.

high likely any host CWE-522 / ASI ASI03

The vulnerable pattern in any host

This finding comes from the any host fixture in the owlwarden test suite. The declaration asks for the entire process environment rather than an explicit allowlist, so every credential the developer has is inside a process this repository configured.

The corrected configuration

Pass an explicit allowlist of environment variables to anything the repository can define, and keep credentials out of command strings, where they are one `echo` away from a log.

"env": { "SERVICE_TOKEN": "${SERVICE_TOKEN}" }

If you are not using any host

Stop passing the credential to a repository-defined command. Give the subprocess an explicit environment allowlist holding only what it needs, and keep everything else out of its reach.

Check your own repository

npx owlwarden scan
npx owlwarden explain agent-config-secret-reachable

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other any host checks

Rules with a tested any host example.

• agent-instructions-directive medium Instruction file tells the agent to bypass its own controls
• agent-mcp-unpinned-remote medium MCP server declaration resolves code at run time

agent-config-secret-reachable for every agent host / All rules / owlwarden