cfgaudit

Rules / CFG001

CFG001 permissions.allow contains unrestricted Bash pattern

Severity: error
OWASP: LLM03:2026 – Excessive Agency

What cfgaudit checks

cfgaudit flags permissions.allow entries that grant the agent permission to execute any shell command without a confirmation prompt. This covers the wildcard specifier Bash(*) / Bash(**) and the bare tool name Bash (no parentheses), which the permissions docs define as equivalent — "Bash matches all Bash commands … Bash(*) is equivalent to Bash". The same applies to PowerShell / PowerShell(*), an equivalent arbitrary-command surface. An unrestricted grant maximises blast radius if the agent is manipulated via prompt injection or a malicious tool response.

Trigger example

{
  "permissions": {
    "allow": ["Bash(*)"]
  }
}

Safe alternative

Scope permissions to the specific commands the agent needs:

{
  "permissions": {
    "allow": ["Bash(go test ./...)", "Bash(make build)", "Bash(make lint)"]
  }
}

Relationship to the SchemaStore schema

The SchemaStore Claude Code settings schema already rejects Bash(*) — its permissionRule pattern requires the args inside parentheses to contain at least one character that is not ), *, or ?. That check only fires in editors and tools that load the schema (VS Code IntelliSense, JSON validators in CI plugins, etc.) and only if the developer has not silenced the warning.

CFG001 catches the same misconfiguration in every other context: file-system audits, pre-commit hooks, scans of checked-out repos by people who do not use the schema-aware editor, and any future relaxation of the upstream schema. Treat the two as complementary, not redundant.

References

Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation