Fix instruction file tells the agent to bypass its own controls in any host

An instruction file matches one of a small, enumerated set of shapes: disregarding prior instructions, skipping the permission prompt, exfiltrating credentials, or fetching and executing remote content. A heuristic over prose - it runs in `deep`, not in `quick`, and it can never exceed `possible`.

medium possible any host CWE-77 / ASI ASI01

The vulnerable pattern in any host

This finding comes from the any host fixture in the owlwarden test suite. This file is loaded into the model's context as authoritative. Text that asks it to override the instructions above it is not a project instruction; it is an attempt to reach past whoever reviewed this file. The phrase is written with characters that disguise it, which is not something a project instruction needs to do.

The corrected configuration

Delete the sentence, and treat the instruction file the way you treat code: it is an input to something that acts on your behalf, and it deserves the same review.

// instructions describe the project, not the agent's controls

If you are not using any host

Delete the sentence. If it was written in good faith - a shortcut for a noisy prompt - say what the project actually needs instead: which commands are safe to run, which directories to leave alone. An instruction file should describe the project, never the agent's own controls.

Check your own repository

npx owlwarden scan
npx owlwarden explain agent-instructions-directive

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other any host checks

Rules with a tested any host example.

• agent-config-secret-reachable high Repository config puts credentials in reach of a repository-controlled command
• agent-mcp-unpinned-remote medium MCP server declaration resolves code at run time

agent-instructions-directive for every agent host / All rules / owlwarden