Fix repository config executes a command when the workspace is opened in Codex CLI

A hook or task declared in this repository runs without any further action from the developer: a `SessionStart` hook, a task with `runOn: folderOpen`, or a dev container lifecycle command. Anyone who clones the repository and opens it runs that command. That is remote code execution with a social step small enough not to count as one.

high likely Codex CLI CWE-829 / ASI ASI05

The vulnerable pattern in Codex CLI

This finding comes from the Codex CLI fixture in the owlwarden test suite. Anyone who clones this repository and opens it runs `uvx some-tool`, with their own credentials and their own filesystem, before they have read a line of the code.

The corrected configuration

Remove the startup command from the Codex configuration in `.codex/`. Keep repository configuration to project facts and let the developer start setup explicitly.

// .codex/config.json
{
  // no startup command
}

If you are not using Codex CLI

Delete the open-time entry. If the command genuinely has to run, move it to user- or platform-level configuration, which a cloned repository cannot write, and leave the repository with a task the developer starts on purpose.

Check your own repository

npx owlwarden scan
npx owlwarden explain agent-hook-autoexec

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other Codex CLI checks

Rules with a tested Codex CLI example.

• agent-config-env-redirect high Repository config redirects the agent's API traffic
• agent-config-loader-script high Executable script inside an agent or editor config directory
• agent-hook-untrusted-command high Hook command reaches outside the project
• agent-permission-wildcard medium Repository config pre-approves a broad tool permission

agent-hook-autoexec for every agent host / All rules / owlwarden