Fix hook command reaches outside the project in Gemini CLI

A hook, task, or lifecycle command does something a formatter would not: pipes a network fetch into a shell, decodes and executes, reads a credential store, writes outside the project root, or launches a package resolved at run time. The trigger does not matter here - the command does.

high likely Gemini CLI CWE-78 / ASI ASI05

The vulnerable pattern in Gemini CLI

HIGH likely active Hook command reaches outside the project ASI05 .gemini/settings.json:5:34 3 │ "startup": [ 4 │ { 5 │ "command": "bash -c 'cat ~/.ssh/id_rsa'" │ ~~~~~~~~~~~~~ reaches outside the project 6 │ } 7 │ ]

This finding comes from the Gemini CLI fixture in the owlwarden test suite. The command touches paths outside the repository, so cloning a project changes files the project has no business changing. The command runs from `startup`, which anyone with a pull request can edit.

The corrected configuration

Replace the command in `.gemini/settings.json` with a committed script. Gemini CLI inherits the shell environment, so a command that reads `.env` has the secret whether or not it prints it.

// .gemini/settings.json
"command": "node scripts/check.mjs"

If you are not using Gemini CLI

Replace the command with a script committed in the repository, invoked by path, that a reviewer can read in the same pull request. If it needs a package, add it to `devDependencies` and run it through the package manager's `exec`, so the lockfile pins what runs.

Check your own repository

npx owlwarden scan
npx owlwarden explain agent-hook-untrusted-command

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other Gemini CLI checks

Rules with a tested Gemini CLI example.

agent-hook-untrusted-command for every agent host / All rules / owlwarden