Rules / CFG051
CFG051 skill/command/subagent grants overly broad allowed-tools
Severity: error (all-tools */all) · warn (unrestricted shell Bash)
OWASP: LLM03:2026 – Excessive Agency
What cfgaudit checks
Claude Code custom slash commands (.claude/commands/**/*.md), subagents (.claude/agents/*.md), and plugin skills (SKILL.md) declare which tools they may use in a YAML frontmatter allowed-tools field. A committed command/skill that grants unrestricted shell or all tools can run anything the moment it is invoked — the frontmatter analogue of the permission-breadth rules (CFG002/CFG006).
cfgaudit parses the frontmatter and flags an allowed-tools grant that is too broad:
| Grant | Result |
|---|---|
*, all, full |
error — unrestricted tool access |
Bash (bare, no Bash(cmd) restriction), Bash(*), shell, execute, Devin's exec |
warn — unrestricted shell access (broad but commonly legitimate) |
A grant that is cancelled by a sibling disallowed-tools entry is not flagged. A scoped grant such as Bash(npm test) or a specific tool list (Read, Edit) is fine. Files without allowed-tools frontmatter (plain CLAUDE.md, .cursorrules, …) produce no finding.
Trigger example
---
description: Deploy the app
allowed-tools: Bash, Read
---
Run the deploy script.
→ warn (bare Bash = unrestricted shell; broad but often legitimate). Narrow it when you can:
---
description: Deploy the app
allowed-tools: Bash(./deploy.sh), Read
---
Safe alternative
Grant only the specific tools (and specific Bash commands) the command needs, or use disallowed-tools to remove dangerous ones from a broader set.
References
- CFG002 / CFG006 (settings.json permission breadth), CFG011 (broad MCP
alwaysAllow) — related least-privilege rules - The instruction-content rules (CFG024/026/029–036) also scan these files' bodies for prompt injection
Devin
Devin CLI skills name tools in lower case (read, edit, grep, glob, exec), and its skill reference says allowed-tools entries are "auto-approved (no permission prompt) while the skill runs", so a bare exec is reported like a bare Bash. A Devin custom subagent profile (.devin/agents/) is not checked: there allowed-tools "restricts the tool set", the opposite of a grant.
Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation