Fix repository config executes a command when the workspace is opened in Gemini CLI
A hook or task declared in this repository runs without any further action from the developer: a `SessionStart` hook, a task with `runOn: folderOpen`, or a dev container lifecycle command. Anyone who clones the repository and opens it runs that command. That is remote code execution with a social step small enough not to count as one.
high likely Gemini CLI CWE-829 / ASI ASI05
The vulnerable pattern in Gemini CLI
This finding comes from the Gemini CLI fixture in the owlwarden test suite. Anyone who clones this repository and opens it runs `bash -c 'cat ~/.ssh/id_rsa'`, with their own credentials and their own filesystem, before they have read a line of the code.
The corrected configuration
Remove the startup entry from `.gemini/settings.json`. Gemini CLI reads user-level settings as well; put anything that must always run there, where the repository has no say.
// .gemini/settings.json
{
// no startup entry
}If you are not using Gemini CLI
Delete the open-time entry. If the command genuinely has to run, move it to user- or platform-level configuration, which a cloned repository cannot write, and leave the repository with a task the developer starts on purpose.
Check your own repository
npx owlwarden scan
npx owlwarden explain agent-hook-autoexecRuns on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.
Other Gemini CLI checks
Rules with a tested Gemini CLI example.
- agent-config-env-redirect high Repository config redirects the agent's API traffic
- agent-hook-untrusted-command high Hook command reaches outside the project
- agent-permission-wildcard medium Repository config pre-approves a broad tool permission
agent-hook-autoexec for every agent host / All rules / owlwarden