Rules
Ruleset 2026.11.6, 129 rules
Each rule says what it looks for, why it matters and how to fix it, in the words every report uses. The parts in italics are filled in from the files a check finds.
The score starts at 100. The first finding from a rule takes off 30 points if it's critical, 15 if it's high, 6 if it's medium and 2 if it's low. Each repeat takes off a quarter of that again, up to twice that for one rule, so one noisy rule can't empty the score. Info findings take off nothing. Grades: A for 90 or more, B for 80 or more, C for 65 or more, D for 50 or more and F below 50. Any critical finding caps the grade at D.
This ruleset has 11 critical, 60 high, 39 medium, 14 low and 5 info rules.
Why it matters. permissions.defaultMode is bypassPermissions, so Claude Code edits files and runs any command without asking. A prompt injection in any file, web page or tool output it reads can then run commands on your computer.
Fix. Remove permissions.defaultMode or set it to "default". For fewer prompts, allow specific commands under permissions.allow instead.
Why it matters. permissions.allow contains “rule”, which pre-approves every shell command. A prompt injection in anything Claude Code reads can then run commands on your computer.
Fix. Replace it with the specific commands you trust, such as Bash(npm test:*).
Why it matters. Claude Code runs it with any arguments and without asking. Interpreters such as python and node, shells and sudo run whatever code they're given, and rm can delete any file you can.
Fix. Remove it from permissions.allow, or narrow it to one exact script, such as Bash(npm run lint).
Why it matters. Claude Code runs it with any arguments and without asking. curl and wget can post any file Claude Code can read to any server, and ssh can run commands on any server your keys reach.
Fix. Remove rule from permissions.allow so Claude Code asks first. For web pages, allow WebFetch for specific domains instead, such as WebFetch(domain:docs.example.com).
Why it matters. The rule covers your home folder or the whole disk, so Claude Code can change shell profiles and other repos without asking.
Fix. Limit edit rules to paths inside the project, such as Edit(src/**).
Why it matters. additionalDirectories gives the agent the same access there as inside the project.
Fix. Remove it, or point it at one specific folder rather than your home folder or a drive.
Why it matters. Variable in a setting sends the agent's requests to host instead of the vendor's service once you trust the folder. Those requests carry your prompts, the code the agent reads and your API key.
Fix. Remove it from the project. If your company routes AI traffic through a gateway, set that in your own settings.
Why it matters. Variable is 0, so the agent or the programs it starts accept any certificate. Anyone on the network between you and a service can read and change the traffic, API keys included.
Fix. Remove it. If your network inspects HTTPS, add its certificate with NODE_EXTRA_CA_CERTS in your own settings instead.
Why it matters. Values under env in file are plain text, and settings files are often committed or synced.
Fix. Move it to your shell environment or a secrets manager, then rotate it.
Why it matters. This file holds Claude Code's account data and user settings. Inside a project, any agent or tool working here can read it, and it can be committed with the code.
Fix. Move it out of the project, and rotate the credential if the file was ever committed or shared.
Why it matters. approval_policy is "never" and sandbox_mode is "danger-full-access", so commands run on your machine without limits or prompts.
Fix. Use sandbox_mode = "workspace-write" with approval_policy = "on-request".
Why it matters. sandbox_mode is "danger-full-access", so commands can touch any file and reach the network.
Fix. Use "workspace-write" and grant extra access for a single task when you need it.
Why it matters. A prefix_rule with decision = "allow", or no decision, lets any command that starts with its pattern run outside the sandbox without asking. The patterns in this file start with list.
Fix. Set decision = "prompt" on these rules, or narrow each pattern to the exact command you need. Delete the rules for commands you approved only once.
Why it matters. Setting turns on automatic approval, so Copilot agent mode runs tools and terminal commands without asking.
Fix. Remove the setting and approve tools per session.
Why it matters. github.copilot.chat.claudeAgent.allowDangerouslySkipPermissions is true, so the Claude agent in Copilot Chat can run commands and edit files without asking.
Fix. Remove the setting.
Why it matters. chat.tools.edits.autoApprove approves edits to VS Code's own settings files, so a prompt injection can have the agent turn on its own auto-approval. That's how CVE-2025-53773 let attackers run code through Copilot.
Fix. Remove the entries that cover .vscode files.
Why it matters. share is "auto", so each conversation, including code and command output, gets a public link.
Fix. Set share to "manual" or "disabled".
Why it matters. permission.bash is "allow", so every shell command runs without asking.
Fix. Set bash to "ask" and allow specific commands, such as "git status": "allow".
Why it matters. agent.tool_permissions.default is "allow", so edits and terminal commands run without asking.
Fix. Set agent.tool_permissions.default to "confirm", and allow specific tools instead.
Why it matters. permissions.allow includes rule, which approves every shell command.
Fix. Allow specific commands instead, such as "Shell(git status)".
Why it matters. Setting in this file pre-approves “rule”, so this agent runs matching commands without asking. A project's agent replaces any of yours with the same name, so in a project from someone else, picking that name runs their version.
Fix. Remove the entry, or allow only the exact commands you need and deny the rest.
Why it matters. sandbox.json sets type to "insecure_none", so commands can change any file and reach the network.
Fix. Remove the setting to use Cursor's sandbox.
Why it matters. yoloModeToggled is true, so Cline approves every action, including commands and file changes, without asking.
Fix. Turn YOLO mode off in Cline's settings.
Why it matters. Auto-approve has “Execute all commands” on, so commands the model itself marks as needing approval run without asking too.
Fix. Turn off “Execute all commands” in Cline's auto-approve settings. “Execute safe commands” still trusts the model to say which commands are safe.
Why it matters. permission_mode is "mode", so commands and file changes run without asking.
Fix. Remove permission_mode to go back to asking first.
Why it matters. amp.dangerouslyAllowAll is true, so commands and file changes run without a prompt.
Fix. Remove the setting and allow specific commands instead.
Why it matters. GOOSE_MODE is auto, so Goose runs commands and changes files without asking.
Fix. Set GOOSE_MODE to "approve" or "smart_approve".
Why it matters. permissions.defaultMode is bypassPermissions in the project's own settings. Claude Code 2.1.257 and later ignore it there and start in the default mode, but older versions skip every prompt for anyone who opens the project.
Fix. Remove permissions.defaultMode from the project's settings, and keep Claude Code up to date.
Why it matters. That includes SSH keys, cloud credentials and other projects, and what Claude Code reads is sent to the model.
Fix. Scope read rules to the project, or deny ~/.ssh, ~/.aws and similar folders.
Why it matters. WebFetch without a domain lets Claude Code open any page without asking. A page can carry instructions for the agent, and the agent can send data out in the address it fetches.
Fix. Allow specific domains instead, such as WebFetch(domain:docs.example.com).
Why it matters. Claude Code runs any of the server's tools without asking, including ones that write, send or delete, and tools the server adds in later versions.
Fix. List the individual tools you use, such as mcp__github__get_issue.
Why it matters. No rule in permissions.deny blocks reading files.
Fix. Add deny rules such as "Read(./.env)", "Read(./.env.*)" and "Read(./secrets/**)".
Why it matters. enableAllProjectMcpServers is true, so a server added to .mcp.json in a pull request starts without a prompt.
Fix. Remove enableAllProjectMcpServers or set it to false, so Claude Code asks you to approve each server in .mcp.json.
Why it matters. enabledMcpjsonServers in file approves servers from this project's .mcp.json, so they start without asking once you trust the folder.
Fix. Remove it from the shared settings. Each person approves the project's servers for themselves.
Why it matters. Variable set by this project adds a certificate authority, and whoever holds its key can read and change the agent's encrypted traffic.
Fix. Remove it from the project. Add a certificate your network needs in your own settings.
Why it matters. approval_policy is "never", so anything the sandbox allows runs without a prompt.
Fix. Use "on-request", so Codex asks before doing anything the sandbox blocks.
Why it matters. It's built by a function, a loop or an expression, so misconfig can't tell which commands it lets run without asking. Codex runs the file as code, so the rule still applies.
Fix. Write each rule out as prefix_rule(pattern = [...], decision = ...), so you and misconfig can read what it allows.
Why it matters. network_access is true under [sandbox_workspace_write], so sandboxed commands can upload files.
Fix. Turn it off and allow the network for a single task when you need it.
Why it matters. chat.tools.terminal.autoApprove lets agent mode run this without asking, and it can change or send data.
Fix. Limit auto-approval to read-only commands such as git status.
Why it matters. session.trust_all_worktrees is true, so any project you open can apply its own settings, including context servers that run commands.
Fix. Remove the setting and trust projects one at a time.
Why it matters. permissions.defaultMode is acceptEdits, so Claude Code applies file edits without review, including edits to scripts and config that run later, such as package.json scripts, a Makefile or CI workflows.
Fix. Set permissions.defaultMode to "default". When you want edits accepted for a while, switch modes in the session with Shift+Tab.
Why it matters. autoAccept is true, so tool calls it considers safe run without asking.
Fix. Set autoAccept to false.
Why it matters. defaultApprovalMode is auto_edit, so Gemini CLI applies file edits without review, including edits to scripts and config that run later.
Fix. Set defaultApprovalMode to "default".
Why it matters. chat.tools.terminal.ignoreDefaultAutoApproveRules is true, so VS Code's own rules, which always ask before commands such as rm, no longer apply.
Fix. Remove the setting.
Why it matters. yes-always is true, so Aider answers yes for you when it asks to add a file to the chat, create a file or edit one that isn't in the chat. Files it adds are sent to the model. Shell commands still need your explicit yes.
Fix. Remove yes-always, so Aider asks before it adds or edits files.
Why it matters. Variable in your own settings sends the agent's requests to host instead of the vendor's service. That's expected if your company routes AI traffic through a gateway. If you didn't set it, another program changed your settings, and host receives your prompts, code and API key.
Fix. Remove it unless you know who runs host.
Why it matters. File asks for YOLO mode, which approves every tool call. Current Gemini CLI ignores it in settings and turns YOLO on only with --yolo or --approval-mode=yolo, so check the scripts and aliases that start Gemini CLI.
Fix. Remove it from file.
Why it matters. File stores the value directly. Config files get committed, synced and read by other tools.
Fix. Load it from an environment variable or an input prompt instead, such as ${env:NAME}, then rotate the key.
Why it matters. Traffic to host is unencrypted, so tokens and tool results can be read or changed in transit.
Fix. Switch the server's URL to https://.
Why it matters. URLs end up in logs, shell history and screenshots.
Fix. Send the credential in a header loaded from an environment variable.
Why it matters. Flag gives the container control over your machine.
Fix. Drop the flag and mount only the folder the server needs.
Why it matters. The server gets your whole home folder or drive, not just this project.
Fix. Pass the project folder instead.
Why it matters. Variable makes the server's program load a module, library or script as it starts, so the server runs code that isn't part of its package.
Fix. Remove variable from the server's env, unless you set it yourself and know what it loads.
Why it matters. “command” fetches the newest release each time the server starts. If a later release is malicious, it runs on your computer with your permissions. That happened with postmark-mcp (Koi Security, September 2025), whose version 1.0.16 secretly copied every email it sent to the attacker.
Fix. Pin package to an exact version. To see the newest, run lookup command.
Why it matters. It starts “path”, which comes with the project, whenever the agent starts the server, with your permissions. In a project from someone else, that's their code.
Fix. Read what it runs before you approve the server, or remove the server.
Why it matters. Any prompt injection that reaches the agent can turn into commands on your machine.
Fix. Keep it off unless you need it, and require approval for its tools.
Why it matters. The setting setting lets the tools run without asking, including any that write files, send data or run commands.
Fix. Remove setting so the agent asks before each tool call. If you want fewer prompts, pre-approve only tools that read.
Why it matters. Each server adds tools the agent can use, and a prompt injection can ask it to use any of them.
Fix. Remove the servers you don't use.
Why it matters. It contains number Unicode tag characters. Most editors and web pages don't display them, but the model receives them as text. Decoded, they read: “the hidden text”
Fix. Delete the hidden characters and check where the file came from.
Why it matters. Host was used by the attack.
Fix. Remove whatever uses it, check what has already run, and change any keys the agent could reach.
Why it matters. Comments don't show when Markdown is rendered, but agents read them.
Fix. Delete the comment, or move real guidance into visible text.
Why it matters. The agent would run whatever that address serves without review, and whoever controls the address can change it at any time.
Fix. Download the installer at a fixed version, check its checksum and run it yourself, or keep the script in the repo, where changes are reviewed.
Why it matters. Whoever set up the address on host, or has the link, can read what's sent there. Security testers use these services, and so do attackers moving stolen data out.
Fix. Remove the address unless you set it up yourself.
Why it matters. “phrase” would expose credentials to the agent and anything it talks to.
Fix. Remove it, and add deny rules for those paths.
Why it matters. A password keeps antivirus and email scanners from looking inside an archive, which is why malware is often shipped that way. The ClawHavoc campaign (Koi Security, February 2026) used one to deliver a trojan.
Fix. Don't run it. Install tools from their official source instead.
Why it matters. Removing the quarantine flag with xattr, or turning Gatekeeper off with spctl, skips the check macOS runs before a downloaded app opens, so the download runs with no warning. Mac info-stealers often tell people to run these commands.
Fix. Don't run it on files you downloaded. Install the tool from a signed release.
Why it matters. It contains characters that change the direction text is displayed in, so what you see on screen can differ from what the agent reads.
Fix. Delete the direction characters, then read the file again.
Why it matters. Number characters that take up no space are in its text. They can hide encoded text, or split words so a search or filter misses them, while the agent still reads them.
Fix. Delete them. If you didn't add them, check where the file came from.
Why it matters. “phrase” tells the agent to set aside its rules. Real project instructions don't need to say that, and prompt injections usually do.
Fix. Remove the line, and check who last changed the file.
Why it matters. Length characters of base64 can hide instructions or a payload.
Fix. Remove it, or replace it with a link to a reviewed file.
Why it matters. It tells people or agents to start an agent with “flag”, which turns off its approval prompts.
Fix. Recommend allowing specific commands in the agent's settings instead.
Why it matters. Whoever runs host decides what the agent does next, and the page can change after this file was reviewed.
Fix. Copy the steps the agent needs into the repository, where changes are reviewed.
Why it matters. Whoever posted the text on host can change it at any time, so what the agent reads later can differ from what you checked. In the ClawHavoc campaign (Koi Security, February 2026), malicious ClawHub skills sent people to a script on a paste site.
Fix. Keep the steps in the repository, where changes are reviewed.
Why it matters. “reference” imports content that isn't reviewed with this repo.
Fix. Copy the content into the repo or drop the import.
Why it matters. Long instruction files are hard to review, so added lines are easy to miss.
Fix. Keep instructions short and move reference material elsewhere.
Why it matters. The files each tell an agent what to do. When they disagree, agents behave differently depending on which file they read.
Fix. Keep one source, such as AGENTS.md, and point the others to it.
Why it matters. It runs “command” automatically, without asking. Whatever that address serves runs on your computer with your permissions, and its owner can change it at any time.
Fix. Remove it, or replace the download with a script kept in the repo.
Why it matters. A script starts an agent with “flag”, which turns off its permission checks.
Fix. Remove the flag, or run that script only inside a throwaway container.
Why it matters. File adds “flag” every time you run the command, so the agent's permission checks never run.
Fix. Remove the flag from your shell profile. For fewer prompts, allow specific commands in the agent's settings instead.
Why it matters. Variable changes what programs load, or which programs run, when the agent starts a command. Set here, it can run the project's own code inside every command, and nothing in the commands shows it.
Fix. Remove variable, unless you set it yourself and know what it loads.
Why it matters. Its runOptions.runOn is "folderOpen", so VS Code and editors built on it run “command” when the folder opens. Cursor ships with Workspace Trust off and runs it without asking. VS Code asks you to trust the folder first, unless Workspace Trust is off.
Fix. Remove runOptions.runOn from the task. In Cursor, set security.workspace.trust.enabled to true, so it asks before it runs a folder's tasks.
Why it matters. It runs “command” automatically, without asking, and can send prompts, files or command output to another computer.
Fix. Remove it unless you run the server it sends to.
Why it matters. On each event, it sends details such as prompts, commands and file paths to host.
Fix. Remove the hook unless you run that server and trust everyone who can read its data.
Why it matters. A data destination in file sends what you do in Continue, such as prompts and edits, to host.
Fix. Remove the destination unless you run that server.
Why it matters. A hook or setting runs “command” automatically, without asking. In a project from someone else, that's their code running on your computer once you trust the folder.
Fix. Keep it only if you know what it runs. In a project from someone else, read the command and any script it starts before you trust the folder.
Why it matters. It runs “command” automatically, without asking, so it can delete or overwrite files each time it runs.
Fix. Remove the command, or limit it to files inside the project.
Why it matters. It runs “command”. That script isn't part of this repo, so it can change without anyone reviewing it.
Fix. Keep the script in the repo.
Why it matters. Agent loads the plugins and tools in this project each time it starts, and they can do anything you can. In a project from someone else, that's their code running on your computer. misconfig lists plugin code by name and doesn't read it.
Fix. Read the code before you start agent in this project, and delete it if you didn't add it.
Why it matters. An agent opened here can read everything in it, including folders.
Fix. Open the agent in a project folder instead.
Why it matters. Files you download from websites land here, and agents treat them as context.
Fix. Move the project into its own folder before running an agent.
Why it matters. Instructions for an agent were found in files. An agent started in folder treats the files there as context, and anything saved there later can add more.
Fix. Start agents in project folders only, and delete instruction files you didn't write.
Why it matters. What can go wrong in that folder. The folder is listed in file.
Fix. Start agents from a project folder. To make agent forget this folder, remove its entry under projects in file.
Why it matters. File marks it as a trusted folder, so agent asks fewer questions there. What can go wrong in that folder.
Fix. Remove that entry from file, and trust only project folders.
Why it matters. File marks it as a trusted project, so Codex asks fewer questions there. What can go wrong in that folder.
Fix. Remove that [projects] entry from file and trust only project folders.
Why it matters. Files can be read by any agent opened here.
Fix. Move them out of the project, and rotate any that were ever committed.
Why it matters. Agents follow the link and read the file as instructions, so what's in it goes to the agent and the model behind it. misconfig didn't open it.
Fix. Replace the link with an ordinary file. If an agent has read it, change the keys in the file it points to.
Why it matters. An agent opened here can read and change all of them.
Fix. Open the agent inside one repository.
Why it matters. Files can be read by agents unless each agent's settings deny them.
Fix. Add deny rules for these files in your agents' settings.
Why it matters. This is a git repo and no ignore rule covers files, so git add . would stage the secrets with the code.
Fix. Add files to .gitignore. If any are already tracked, run git rm --cached on them, then rotate the secrets they hold.
Why it matters. Agents read the settings, rules and skills in it as this project's own. misconfig didn't open it, since it isn't part of the project.
Fix. Replace the link with a real folder in the project. If you made the link on purpose, check what's in the folder by hand.
Why it matters. Agents follow the link and read the file it points to as instructions. misconfig didn't open it. In a project from someone else, a link like this can put a file from your computer into what the agent reads.
Fix. Replace the link with an ordinary file in the project. If you made the link on purpose, check the file it points to by hand.
Why it matters. No ignore rule covers files, so settings meant for one person can end up in the repo.
Fix. Add files to .gitignore.
Why it matters. Its settings couldn't be read, usually because it isn't valid JSON or TOML, so none of them were checked. The agent may still apply some of them.
Fix. Fix the syntax error, then run the check again.
Why it matters. misconfig reads agent files up to 400 KB, and this one is larger, so only its start was checked. The agent still reads the whole file.
Fix. Review the rest by hand, or split it into smaller files.
Why it matters. misconfig reads agent files up to 400 KB each and 4 MB in all. This one is over a limit, so nothing in it was checked, but the agent still reads it.
Fix. Review it by hand, or split it into smaller files.
Why it matters. Package is what it does. Source: source.
Fix. Remove the server, then change any keys and tokens your agent could reach.
Why it matters. Extension version is what it does. Source: source.
Fix. The steps to take.
Why it matters. It's what it does. Source: source.
Fix. Remove it, delete node_modules and reinstall from a clean lockfile, then change your GitHub, npm and cloud keys.
Why it matters. It's what it does. Source: source. The next clean install, in CI or on another computer, installs it.
Fix. The fix for the lockfile. If it was ever installed, change your GitHub, npm and cloud keys.
Why it matters. What it does. Found: files.
Fix. The steps to take.
Why it matters. What it does.
Fix. The steps to take.
Why it matters. What it does.
Fix. The steps to take.
Why it matters. OSV.dev lists package as malicious (reference). Where it's used.
Fix. Remove it, then change any keys and tokens it could reach.
Why it matters. Versions of package were malware. The server doesn't pin a version, so it may have run one of them. Source: source.
Fix. Remove the server, or pin package to a version you've checked, and change any keys your agent could reach.
Why it matters. The name is close to official name, but it's a different package. Lookalike names are how malicious packages get installed by mistake, including by AI agents that guess a package's name.
Fix. Check who publishes package. If you meant official name, switch to it.
Why it matters. Files there come from downloads and other programs, not from a release you chose, and anything that can write there can change what the server runs.
Fix. Install the server from its official release, or move the program somewhere only you control.
Why it matters. Its name copies the official official name extension, official ID, but someone else publishes it. Extensions run with your permissions as soon as the editor loads them, so a copy can do anything you can.
Fix. If you meant to install official name, uninstall extension and install official ID instead.
Why it matters. The most serious: worst issue (reference). Version version has every fix.
Fix. Update agent: update command.
Why it matters. The most serious: summary (reference). Found on OSV.dev. Where it's used.
Fix. The steps to take.
Why it matters. Whatever is there when the server starts is what runs, with your permissions. A change there needs no release and no review.
Fix. Use a published release with a pinned version, or pin the repository to a commit.
Why it matters. The most serious: worst issue (reference). Version version has every fix.
Fix. Update agent: update command.
Why it matters. What it does. Found: files.
Fix. The steps to take.
Why it matters. What it does.
Fix. The steps to take.
Why it matters. Files can't be read like the rest of a skill, and the skill can tell the agent to run them. Skills from public registries have been used to deliver malware.
Fix. Remove the skill unless you trust where it came from, and get any tool it needs from the tool's own release.
Why it matters. The most serious: summary (reference). Found on OSV.dev. Where it's used.
Fix. The steps to take.
Why it matters. An extension installed from a VSIX file skips the marketplace's checks and doesn't update itself, so security fixes don't reach it.
Fix. Reinstall from the marketplace where you can.
Why it matters. The most serious: worst issue (reference). Version version has every fix.
Fix. Update agent: update command.
Why it matters. The marketplaces. A plugin runs with Claude Code's access. misconfig checks plugins' hooks and MCP servers, not the rest of their code.
Fix. Remove marketplaces you don't use with /plugin marketplace remove, and read a plugin before you install it.
Why it matters. The most serious: summary (reference). Found on OSV.dev. Where it's used.
Fix. The steps to take.
The checks are plain JavaScript, the same in the browser check and the command. catalog.js holds the wording on this page, and index.js the checks that apply it.
misconfig.ai