Fix hook command reaches outside the project in Codex CLI

A hook, task, or lifecycle command does something a formatter would not: pipes a network fetch into a shell, decodes and executes, reads a credential store, writes outside the project root, or launches a package resolved at run time. The trigger does not matter here - the command does.

high likely Codex CLI CWE-78 / ASI ASI05

The vulnerable pattern in Codex CLI

This finding comes from the Codex CLI fixture in the owlwarden test suite. The code that runs today is not necessarily the code that ran yesterday. There is no version in the repository to review, and no lockfile entry to audit. The command runs from `onStartup`, which anyone with a pull request can edit.

The corrected configuration

Replace the command in `.codex/` with a repository script invoked by path, and pin any tool it needs in `devDependencies` rather than resolving it when the hook fires.

// .codex/config.json
"command": "node scripts/check.mjs"

If you are not using Codex CLI

Replace the command with a script committed in the repository, invoked by path, that a reviewer can read in the same pull request. If it needs a package, add it to `devDependencies` and run it through the package manager's `exec`, so the lockfile pins what runs.

Check your own repository

npx owlwarden scan
npx owlwarden explain agent-hook-untrusted-command

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other Codex CLI checks

Rules with a tested Codex CLI example.

• agent-config-env-redirect high Repository config redirects the agent's API traffic
• agent-config-loader-script high Executable script inside an agent or editor config directory
• agent-hook-autoexec high Repository config executes a command when the workspace is opened
• agent-permission-wildcard medium Repository config pre-approves a broad tool permission

agent-hook-untrusted-command for every agent host / All rules / owlwarden