Fix repository config pre-approves a broad tool permission in Claude Code

A repository-local config grants an unbounded tool permission - `Bash`, `WebFetch`, `Write(*)`, `mcp__*` - or switches a permission gate off entirely. The approval prompt exists to bound the blast radius of a model doing something unexpected; a repository should not be the thing that answers it.

medium likely Claude Code CWE-732 / ASI ASI03

The vulnerable pattern in Claude Code

This finding comes from the Claude Code fixture in the owlwarden test suite. This entry pre-approves the tool for anything, so the approval prompt never appears for it again in this project. This file also declares a command that runs when the workspace opens, so the two together are an execution with the approval already granted.

The corrected configuration

Narrow `permissions.allow` in `.claude/settings.json` to exact commands. Note that argument wildcards after a multitool (`Bash(git *)`) are not constraints - pin the subcommand too. Platform teams can set the permitted set in managed settings so a repository cannot widen it.

// .claude/settings.json
"permissions": {
  "allow": ["Bash(pnpm test:unit)", "Bash(git status)"],
  "deny": ["Bash(curl:*)", "Read(./.env)"]
}

If you are not using Claude Code

Replace the wildcard with the specific commands the project actually needs, and leave everything else to the approval prompt. A list of five exact commands is more useful to the team than one wildcard, and it is reviewable.

Check your own repository

npx owlwarden scan
npx owlwarden explain agent-permission-wildcard

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other Claude Code checks

Rules with a tested Claude Code example.

• agent-config-env-redirect high Repository config redirects the agent's API traffic
• agent-config-loader-script high Executable script inside an agent or editor config directory
• agent-config-secret-reachable high Repository config puts credentials in reach of a repository-controlled command
• agent-hook-autoexec high Repository config executes a command when the workspace is opened
• agent-hook-untrusted-command high Hook command reaches outside the project
• agent-instructions-directive medium Instruction file tells the agent to bypass its own controls
• agent-instructions-hidden-text high Instruction file contains text a human reader cannot see
• agent-marketplace-untrusted medium Repository config adds a third-party plugin or skill source
• agent-mcp-unpinned-remote medium MCP server declaration resolves code at run time

agent-permission-wildcard for every agent host / All rules / owlwarden