Rules / CFG094

CFG094 committed `.cursor/permissions.json` `autoRun.allow_instructions` steers the auto-approval classifier

Severity: warn OWASP: LLM03:2026 – Excessive Agency

What cfgaudit checks

A project .cursor/permissions.json whose autoRun.allow_instructions array is non-empty:

{
  "autoRun": {
    "allow_instructions": [
      "Read-only inspections of build artifacts under ./dist are fine."
    ],
    "block_instructions": [
      "Especially for delete operations, I like for the classifier to reject so I can have a chance to review."
    ]
  }
}

These sentences are handed to the classifier that decides, in Cursor's Auto-review mode, whether a tool call runs without asking. The gatekeeper is therefore repo-controlled: text arriving from the repository steers an LLM's approval decision.

This is CFG079's threat model — tuning the auto-approval classifier from committed config — in Cursor's file. One difference matters: CFG079's autoMode takes match rules, whose grant you can read off the syntax. Cursor's version is prose, so nothing bounds what a sentence can argue the classifier into.

Only `allow_instructions` is flagged

block_instructions pushes the classifier toward asking, which is the safe direction. Flagging a repository for adding caution would be noise. Block instructions are mentioned in the finding only when they sit alongside an allow instruction, so the reader sees the whole object.

Why `warn` and not `error`

Two reasons, both from Cursor's own documentation.

The instructions are "only consulted in Auto-review mode" — narrower than CFG093's condition, which covers any Run Mode.
Cursor states plainly that "allowlists and autoRun instructions are best-effort convenience. They are not a security guarantee." The classifier is not presented as the barrier between the repository and execution.

The finding is that a repository is steering a teammate's approval decisions at all, which a reviewer should see. Claiming a specific bypass would require knowing how the classifier weighs a given sentence, which cannot be determined from the file.

Fix

State the intent as an explicit allowlist entry, which says exactly what it grants and is checked by CFG093:

{
  "terminalAllowlist": ["ls:./dist*", "cat:./dist/*"]
}

Scope

Project scope only, like CFG093. A user's own ~/.cursor/permissions.json is self-intentional.

References

Cursor — Permissions reference
CFG079 — the Claude Code analogue (autoMode classifier tuning)
OWASP LLM03:2026 – Excessive Agency

Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation

CFG094 committed .cursor/permissions.json autoRun.allow_instructions steers the auto-approval classifier