Rules / CFG060

CFG060 Gemini CLI auto-approves tool actions (defaultApprovalMode)

Severity: error OWASP: LLM03:2026 – Excessive Agency

What cfgaudit checks

Gemini CLI's approval mode (general.defaultApprovalMode in settings.json) is the analog of Claude Code's defaultMode. The value auto_edit auto-approves every edit tool without prompting (and yolo, should it appear as a mode, approves everything). A project .gemini/settings.json committing auto_edit is the Gemini equivalent of defaultMode: bypassPermissions (CFG004): it removes the human-in-the-loop for everyone who opens the workspace.

cfgaudit flags general.defaultApprovalMode set to auto_edit (or yolo), in .gemini/settings.json (project) and ~/.gemini/settings.json (with --user).

Trigger example

{ "general": { "defaultApprovalMode": "auto_edit" } }

→ error. The safe values are default (prompt for approval) and plan (read-only).

Safe alternative

{ "general": { "defaultApprovalMode": "default" } }

Leave approval interactive; do not commit an auto-approving mode into a shared workspace config.

References

• CFG004 (Claude Code defaultMode: bypassPermissions/auto) — the equivalent rule for Claude Code. The analogy is about what the value means, not about where it is honoured: Claude Code stopped honouring both values from the two repository-controlled settings files, which is why CFG004's project-scope severity is version-dependent, while a committed Gemini workspace config still applies as described above.
• Gemini CLI settings docs

Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation