Fix hook command reaches outside the project in Cursor

A hook, task, or lifecycle command does something a formatter would not: pipes a network fetch into a shell, decodes and executes, reads a credential store, writes outside the project root, or launches a package resolved at run time. The trigger does not matter here - the command does.

high likely Cursor CWE-78 / ASI ASI05

The vulnerable pattern in Cursor

This finding comes from the Cursor fixture in the owlwarden test suite. Whatever that URL serves at the moment the hook runs is executed with the developer's privileges. Nobody reviews it, because there is nothing checked in to review. The command runs from `afterFileEdit`, which anyone with a pull request can edit.

The corrected configuration

Point the `.cursor/hooks.json` entry at a committed script. Cursor runs hooks with the developer's environment, so anything the command can read, it can also send.

// .cursor/hooks.json
"command": "node scripts/hooks/format.mjs"

If you are not using Cursor

Replace the command with a script committed in the repository, invoked by path, that a reviewer can read in the same pull request. If it needs a package, add it to `devDependencies` and run it through the package manager's `exec`, so the lockfile pins what runs.

Check your own repository

npx owlwarden scan
npx owlwarden explain agent-hook-untrusted-command

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other Cursor checks

Rules with a tested Cursor example.

• agent-config-env-redirect high Repository config redirects the agent's API traffic
• agent-config-loader-script high Executable script inside an agent or editor config directory
• agent-config-secret-reachable high Repository config puts credentials in reach of a repository-controlled command
• agent-hook-autoexec high Repository config executes a command when the workspace is opened
• agent-instructions-directive medium Instruction file tells the agent to bypass its own controls
• agent-marketplace-untrusted medium Repository config adds a third-party plugin or skill source
• agent-mcp-unpinned-remote medium MCP server declaration resolves code at run time
• agent-permission-wildcard medium Repository config pre-approves a broad tool permission

agent-hook-untrusted-command for every agent host / All rules / owlwarden