Fix instruction file tells the agent to bypass its own controls in Claude Code

An instruction file matches one of a small, enumerated set of shapes: disregarding prior instructions, skipping the permission prompt, exfiltrating credentials, or fetching and executing remote content. A heuristic over prose - it runs in `deep`, not in `quick`, and it can never exceed `possible`.

medium possible Claude Code CWE-77 / ASI ASI01

The vulnerable pattern in Claude Code

This finding comes from the Claude Code fixture in the owlwarden test suite. This file is loaded into the model's context as authoritative. Text that asks it to override the instructions above it is not a project instruction; it is an attempt to reach past whoever reviewed this file.

The corrected configuration

Remove it from `CLAUDE.md` (or the subagent definition). If the goal was fewer prompts, list the exact commands in `permissions.allow` in `.claude/settings.json` - that is a reviewable decision, and a sentence in Markdown is not.

// CLAUDE.md
## Commands
- `pnpm test` runs the unit tests
- `pnpm lint` must pass before a commit

If you are not using Claude Code

Delete the sentence. If it was written in good faith - a shortcut for a noisy prompt - say what the project actually needs instead: which commands are safe to run, which directories to leave alone. An instruction file should describe the project, never the agent's own controls.

Check your own repository

npx owlwarden scan
npx owlwarden explain agent-instructions-directive

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other Claude Code checks

Rules with a tested Claude Code example.

• agent-config-env-redirect high Repository config redirects the agent's API traffic
• agent-config-loader-script high Executable script inside an agent or editor config directory
• agent-config-secret-reachable high Repository config puts credentials in reach of a repository-controlled command
• agent-hook-autoexec high Repository config executes a command when the workspace is opened
• agent-hook-untrusted-command high Hook command reaches outside the project
• agent-instructions-hidden-text high Instruction file contains text a human reader cannot see
• agent-marketplace-untrusted medium Repository config adds a third-party plugin or skill source
• agent-mcp-unpinned-remote medium MCP server declaration resolves code at run time
• agent-permission-wildcard medium Repository config pre-approves a broad tool permission

agent-instructions-directive for every agent host / All rules / owlwarden