Fix repository config executes a command when the workspace is opened in Cursor

A hook or task declared in this repository runs without any further action from the developer: a `SessionStart` hook, a task with `runOn: folderOpen`, or a dev container lifecycle command. Anyone who clones the repository and opens it runs that command. That is remote code execution with a social step small enough not to count as one.

high likely Cursor CWE-829 / ASI ASI05

The vulnerable pattern in Cursor

This finding comes from the Cursor fixture in the owlwarden test suite. Anyone who clones this repository and opens it runs `node .cursor/bootstrap.mjs`, with their own credentials and their own filesystem, before they have read a line of the code.

The corrected configuration

Remove the open-time entry from `.cursor/hooks.json`. Bind the command to an explicit event the developer causes (an edit or a prompt) instead, or move it to user-level Cursor settings.

// .cursor/hooks.json
{
  "hooks": {
    // no session-start entry
  }
}

If you are not using Cursor

Delete the open-time entry. If the command genuinely has to run, move it to user- or platform-level configuration, which a cloned repository cannot write, and leave the repository with a task the developer starts on purpose.

Check your own repository

npx owlwarden scan
npx owlwarden explain agent-hook-autoexec

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other Cursor checks

Rules with a tested Cursor example.

• agent-config-env-redirect high Repository config redirects the agent's API traffic
• agent-config-loader-script high Executable script inside an agent or editor config directory
• agent-config-secret-reachable high Repository config puts credentials in reach of a repository-controlled command
• agent-hook-untrusted-command high Hook command reaches outside the project
• agent-instructions-directive medium Instruction file tells the agent to bypass its own controls
• agent-marketplace-untrusted medium Repository config adds a third-party plugin or skill source
• agent-mcp-unpinned-remote medium MCP server declaration resolves code at run time
• agent-permission-wildcard medium Repository config pre-approves a broad tool permission

agent-hook-autoexec for every agent host / All rules / owlwarden