Fix repository config pre-approves a broad tool permission in Codex CLI

A repository-local config grants an unbounded tool permission - `Bash`, `WebFetch`, `Write(*)`, `mcp__*` - or switches a permission gate off entirely. The approval prompt exists to bound the blast radius of a model doing something unexpected; a repository should not be the thing that answers it.

medium likely Codex CLI CWE-732 / ASI ASI03

The vulnerable pattern in Codex CLI

This finding comes from the Codex CLI fixture in the owlwarden test suite. `autoApprove` is set to `true`, which removes the approval step for the whole session. The prompt is the control; a repository that answers it in advance has removed the control. This file also declares a command that runs when the workspace opens, so the two together are an execution with the approval already granted.

The corrected configuration

Set the approval policy in the user-level Codex configuration and keep the repository's to project facts. Where a sandbox mode is available, prefer it to a broad allow list.

// ~/.codex/config.json
"approvalPolicy": "on-request"

If you are not using Codex CLI

Replace the wildcard with the specific commands the project actually needs, and leave everything else to the approval prompt. A list of five exact commands is more useful to the team than one wildcard, and it is reviewable.

Check your own repository

npx owlwarden scan
npx owlwarden explain agent-permission-wildcard

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other Codex CLI checks

Rules with a tested Codex CLI example.

• agent-config-env-redirect high Repository config redirects the agent's API traffic
• agent-config-loader-script high Executable script inside an agent or editor config directory
• agent-hook-autoexec high Repository config executes a command when the workspace is opened
• agent-hook-untrusted-command high Hook command reaches outside the project

agent-permission-wildcard for every agent host / All rules / owlwarden