Hook command reaches outside the project
A hook, task, or lifecycle command does something a formatter would not: pipes a network fetch into a shell, decodes and executes, reads a credential store, writes outside the project root, or launches a package resolved at run time. The trigger does not matter here - the command does.
high likely agent workspace ASI ASI05 / CWE-78
What it looks like
From .claude/settings.json in the fixture suite.
The fixture test asserts this finding.
How to fix it
Replace the command with a script committed in the repository, invoked by path, that a reviewer can read in the same pull request. If it needs a package, add it to `devDependencies` and run it through the package manager's `exec`, so the lockfile pins what runs.
"command": "node scripts/setup.mjs"The fix for your agent host
Choose the configuration format used by your host.
Check your own repository
npx owlwarden scan --preset deep
npx owlwarden explain agent-hook-untrusted-command
explain prints the rule and fixes in the terminal. It does not
use the network.
Related rules
- agent-config-env-redirect high Repository config redirects the agent's API traffic
- agent-config-loader-script high Executable script inside an agent or editor config directory
- agent-config-secret-reachable high Repository config puts credentials in reach of a repository-controlled command
- agent-hook-autoexec high Repository config executes a command when the workspace is opened