Rules
All 116 rules of cfgaudit 1.18.1, grouped by their category in the OWASP Top 10 for LLM Applications 2026. Severity error fails a scan, warn fails it only with --strict.
LLM01 Prompt Injection
Text the agent reads as trusted context tells it to do something else: override phrases, hidden Unicode, fake turn boundaries and concealment orders in CLAUDE.md, AGENTS.md, rules files, skills and commands.
| Rule | Severity | What it reports |
|---|---|---|
| CFG009 | warn/error | hook command interpolates a shell variable |
| CFG015 | warn/error | hook command contains shell substitution |
| CFG024 | error | instruction file contains hidden Unicode control characters |
| CFG026 | error/warn | instruction file contains instruction-bypass phrases |
| CFG030 | error | instruction file instructs the agent to conceal its behavior |
| CFG032 | error/warn | instruction file contains system-prompt control tokens or pseudo-system tags |
| CFG034 | warn | instruction file contains Guidance/Jinja template syntax |
| CFG056 | warn | skill/command/subagent has a broad/always-on invocation trigger |
| CFG057 | warn | encoded/hidden payload in an instruction file |
| CFG080 | error | instruction file hides a directive inside an HTML comment |
| CFG081 | error | instruction file tells the agent to survive context compaction |
| CFG092 | error | committed Kimi agent file replaces the whole system prompt (override: true) |
| CFG113 | warn/error | an instruction file tells the agent to fetch remote text and follow it |
| CFG116 | warn | an instruction file imports a file from outside the repository |
LLM02 Sensitive Information Disclosure
Secrets and private files reach the model or leave the machine: credentials committed in settings and MCP configs, missing deny rules for .env and keys, commands that read credential files or send data to a remote host.
| Rule | Severity | What it reports |
|---|---|---|
| CFG005 | error | ANTHROPIC_BASE_URL points to a non-Anthropic endpoint |
| CFG007 | error | hardcoded secret in env block |
| CFG012 | error/warn | settings.json structure does not match the official schema |
| CFG013 | warn | local Claude files exist but are not excluded in .gitignore |
| CFG016 | error/info | credential helper defined in project-scoped settings |
| CFG021 | warn | MCP server env routes traffic through a non-local proxy |
| CFG031 | error/warn | instruction file references sensitive file paths |
| CFG033 | error | instruction file contains a markdown image exfiltration pattern |
| CFG036 | error/warn | instruction file embeds shell commands for auto-execution or exfiltration |
| CFG037 | error | command reads or copies SSH private keys |
| CFG038 | error | command dumps environment variables to the network |
| CFG041 | error | permissions.deny does not restrict access to .env files |
| CFG042 | error | permissions.deny does not restrict private key / certificate files |
| CFG043 | error | permissions.deny does not restrict cloud provider credential files |
| CFG044 | error | permissions.deny does not restrict SSH private keys |
| CFG046 | warn/error/info | OTEL exporter endpoint redirects telemetry off-host |
| CFG049 | error/warn | remote MCP server URL points to a non-loopback host |
| CFG050 | error | hardcoded secret in an MCP server env or headers |
| CFG054 | warn | high-entropy value that looks like a hardcoded secret |
| CFG058 | warn | MCP server uses the deprecated sse transport |
| CFG065 | error | Continue config has a hardcoded inline apiKey |
| CFG068 | error | templated credential forwarded to a cleartext / raw-IP MCP endpoint |
| CFG069 | warn | HTTP-transport MCP server without log redaction |
| CFG071 | error | model/provider base URL sends the API key over cleartext |
| CFG072 | error | DNS-channel exfiltration in a command |
| CFG073 | error | hardcoded cryptocurrency signing credential |
| CFG075 | error | MCP server disables TLS certificate verification (MITM kill switch) |
| CFG078 | error | command reads an OS credential store |
| CFG082 | warn/error | Docker daemon redirected off-host (DOCKER_HOST / docker -H) |
| CFG088 | error/warn | http hook posts agent events to a remote endpoint |
| CFG097 | error | committed Gemini remote agent uses cleartext or carries a credential |
| CFG099 | error/warn | qwen settings pick the agent's infrastructure |
| CFG112 | error/info | an MCP server sends a local file as its bearer token |
| CFG115 | warn | a committed config path is a symbolic link leaving the repository |
LLM03 Excessive Agency
The agent can do more than the task needs without asking: unrestricted shell and write permissions, bypass and YOLO modes, auto-approved MCP servers, hooks that run on every session, instructions not to ask for confirmation.
| Rule | Severity | What it reports |
|---|---|---|
| CFG001 | error | permissions.allow contains unrestricted Bash pattern |
| CFG002 | warn | permissions.allow contains unrestricted file-write pattern |
| CFG003 | error | enableAllProjectMcpServers: true |
| CFG004 | error/warn/info | defaultMode set to bypassPermissions or auto |
| CFG006 | warn | permissions.deny is absent or empty |
| CFG008 | error | hook command contains reverse-shell pattern |
| CFG011 | warn | MCP server alwaysAllow is too broad |
| CFG017 | error | MCP server sets dangerouslyAllowBrowser: true |
| CFG018 | warn | MCP server binds to all network interfaces (NeighborJack) |
| CFG019 | error | MCP server command is an inline-script interpreter |
| CFG020 | error | MCP server env injects code at process startup |
| CFG022 | error/warn | sandbox config weakens or hijacks the execution sandbox |
| CFG023 | error/warn | permissions.allow grants a dangerous command with open-ended args |
| CFG025 | error | custom organisation policy (require-deny / forbid-allow) |
| CFG027 | error | command installs a persistence mechanism |
| CFG028 | error | command writes to a Claude trust/config file |
| CFG029 | error | instruction file instructs the agent to bypass permission prompts |
| CFG035 | error/warn | instruction file instructs the agent to configure or trust an MCP server |
| CFG039 | warn/error | command contains recursive force-delete (rm -rf) |
| CFG040 | warn | permissions.allow contains unrestricted WebFetch |
| CFG045 | error/warn/info | ShellCheck analysis of hook / helper commands |
| CFG047 | error/warn | a committed task file auto-runs a command |
| CFG048 | error/warn/info | .vscode/settings.json blanket-auto-approves agent tools |
| CFG051 | error/warn | skill/command/subagent grants overly broad allowed-tools |
| CFG053 | error/warn | blanket MCP-trust settings beyond enableAllProjectMcpServers |
| CFG060 | error | Gemini CLI auto-approves tool actions (defaultApprovalMode) |
| CFG061 | error/warn | Gemini CLI sandbox weakened (tools.sandbox*) |
| CFG063 | error/warn | Codex CLI removes the human from the approval loop |
| CFG064 | error/warn | Codex CLI sandbox disabled or widened |
| CFG066 | warn/error | MCP server env sets a wildcard CORS origin |
| CFG076 | error/warn | MCP server exposes a broad filesystem root |
| CFG077 | error | command destroys an audit trail (anti-forensics) |
| CFG079 | error/warn | autoMode weakens the auto-mode permission classifier |
| CFG083 | error | MCP server args carry a Chromium command-replacing launch switch |
| CFG085 | error/warn | subagent frontmatter weakens the permission mode |
| CFG087 | error/warn | committed agent hook auto-approves tool calls |
| CFG090 | warn | instruction directs the agent to scan or enumerate an internal network |
| CFG091 | error | qwen-code auto-approves every tool call (tools.approvalMode: "yolo") |
| CFG093 | error/warn | committed .cursor/permissions.json allowlist auto-approves terminal commands or MCP tools |
| CFG094 | warn | committed .cursor/permissions.json autoRun.allow_instructions steers the auto-approval classifier |
| CFG095 | error/warn | committed .cursor/sandbox.json weakens the agent's execution sandbox |
| CFG096 | error | committed Gemini MCP server declared trust: true |
| CFG101 | warn | a deny rule constrains bundled short flags, which reordering walks past |
| CFG103 | error/warn | a committed Codex config turns off, blunts, or rewrites Guardian v2 |
| CFG104 | warn | a committed Devin allow rule removes the approval prompt |
| CFG105 | warn | a committed OpenCode permission block removes one of the two remaining prompts |
| CFG106 | error/warn | a committed Codex config grants browser or desktop-application access |
| CFG107 | error | a committed Codex config injects code into every spawned shell |
| CFG108 | error/info | a committed scheduled_tasks.json runs prompts on a timer |
| CFG109 | error | a committed agent config file cannot be parsed |
| CFG110 | error/warn/info | a Claude Code settings env block injects code into every hook and Bash command |
| CFG111 | error/info | a permission rule or hook matcher holds an invisible character, so it does nothing |
LLM04 Supply Chain
Code the agent runs can change under it: unpinned MCP packages and images, plugins and marketplaces controlled by a committed file, remote installers piped into a shell, skills that ask to run a downloaded archive.
| Rule | Severity | What it reports |
|---|---|---|
| CFG010 | warn | MCP server uses an unpinned package or image version |
| CFG014 | error | hook command downloads and executes remote code (curl | sh) |
| CFG052 | warn | MCP server name declared in multiple config sources |
| CFG055 | error/warn | committed settings enables a plugin or registers a marketplace |
| CFG059 | error/warn | MCP server / hook package & endpoint typosquatting |
| CFG062 | warn | Gemini CLI allows unrestricted Git extensions (security.blockGitExtensions) |
| CFG067 | warn | hooks defined in a project-scoped settings file |
| CFG070 | warn | MCP server command is a repo-relative path |
| CFG074 | warn | skills-lock.json pulls skill content from an unpinned source |
| CFG084 | warn | container image trust verification disabled |
| CFG086 | error | committed agent hook runs on a zero-click event |
| CFG089 | warn/info | Copilot repository settings auto-install third-party plugins |
| CFG098 | error/warn | marketplace.json publishes a plugin nothing pins |
| CFG100 | warn | Grok [plugins] turns plugins on or widens where they load from |
| CFG102 | warn | two committed skills claim the same name, and one is silently dropped |
| CFG114 | error/info | committed agent plugin or extension code runs from the repository |