Rules / CFG002

CFG002 `permissions.allow` contains unrestricted file-write pattern

Severity: warn
OWASP: LLM03:2026 – Excessive Agency

What cfgaudit checks

cfgaudit flags permissions.allow entries that let the agent overwrite any file in the workspace without a confirmation prompt: the wildcard specifier Edit(*) / Write(*) (and Edit(**) / Write(**)) and the bare tool name Edit / Write (no parentheses), which the permissions docs define as a whole-tool grant equivalent to the wildcard form. Combined with a prompt injection attack, this allows an adversary to corrupt source files, configuration, or secrets.

Trigger example

{
  "permissions": {
    "allow": ["Edit(*)", "Write(*)"]
  }
}

Safe alternative

Scope to the directories the agent actually needs to modify:

{
  "permissions": {
    "allow": ["Edit(src/**)", "Write(output/*)"]
  }
}

Relationship to the SchemaStore schema

The SchemaStore Claude Code settings schema already rejects Edit(*) and Write(*) — its permissionRule pattern requires the args inside parentheses to contain at least one character that is not ), *, or ?. That check only fires in editors and tools that load the schema (VS Code IntelliSense, JSON validators in CI plugins, etc.) and only if the developer has not silenced the warning.

CFG002 catches the same misconfiguration in every other context: file-system audits, pre-commit hooks, scans of checked-out repos by people who do not use the schema-aware editor, and any future relaxation of the upstream schema. Treat the two as complementary, not redundant.

References

Claude Code docs: Permissions
CFG001: unrestricted Bash(*)
CFG006: missing permissions.deny

Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation

CFG002 permissions.allow contains unrestricted file-write pattern