Repository config executes a command when the workspace is opened

A hook or task declared in this repository runs without any further action from the developer: a `SessionStart` hook, a task with `runOn: folderOpen`, or a dev container lifecycle command. Anyone who clones the repository and opens it runs that command. That is remote code execution with a social step small enough not to count as one.

high likely agent workspace ASI ASI05 / CWE-829

What it looks like

From .claude/settings.json in the fixture suite. The fixture test asserts this finding.

How to fix it

Delete the open-time entry. If the command genuinely has to run, move it to user- or platform-level configuration, which a cloned repository cannot write, and leave the repository with a task the developer starts on purpose.

// remove the entry that runs on open

The fix for your agent host

Choose the configuration format used by your host.

• Claude Code
• Cursor
• VS Code
• Codex CLI
• Gemini CLI

Check your own repository

npx owlwarden scan --preset deep
npx owlwarden explain agent-hook-autoexec

explain prints the rule and fixes in the terminal. It does not use the network.

Related rules

• agent-config-env-redirect high Repository config redirects the agent's API traffic
• agent-config-loader-script high Executable script inside an agent or editor config directory
• agent-config-secret-reachable high Repository config puts credentials in reach of a repository-controlled command
• agent-hook-untrusted-command high Hook command reaches outside the project

All 25 rules / owlwarden