Repository config pre-approves a broad tool permission
A repository-local config grants an unbounded tool permission - `Bash`, `WebFetch`, `Write(*)`, `mcp__*` - or switches a permission gate off entirely. The approval prompt exists to bound the blast radius of a model doing something unexpected; a repository should not be the thing that answers it.
medium likely agent workspace ASI ASI03 / CWE-732
What it looks like
From .claude/settings.json in the fixture suite.
The fixture test asserts this finding.
How to fix it
Replace the wildcard with the specific commands the project actually needs, and leave everything else to the approval prompt. A list of five exact commands is more useful to the team than one wildcard, and it is reviewable.
"allow": ["Bash(pnpm test)", "Bash(pnpm lint)"]The fix for your agent host
Choose the configuration format used by your host.
Check your own repository
npx owlwarden scan --preset deep
npx owlwarden explain agent-permission-wildcard
explain prints the rule and fixes in the terminal. It does not
use the network.
Related rules
- agent-config-env-redirect high Repository config redirects the agent's API traffic
- agent-config-loader-script high Executable script inside an agent or editor config directory
- agent-config-secret-reachable high Repository config puts credentials in reach of a repository-controlled command
- agent-hook-autoexec high Repository config executes a command when the workspace is opened