Rules / CFG097

CFG097 committed Gemini remote agent uses cleartext or carries a credential

Severity: error OWASP: LLM02:2026 – Sensitive Information Disclosure

What cfgaudit checks

A .gemini/agents/*.md whose frontmatter carries agent_card_url, agent_card_json or auth is a remote agent (agentLoader.ts, guessIntendedKind). Gemini fetches the A2A agent card at that URL and then talks to whatever it describes, using the credentials the same file supplies. Those files are project-level and team-shared, so both decisions are made for everyone who opens the repo.

Finding	Severity
`agent_card_url` is `http://` to a non-loopback host	`error`
an `auth` value is a credential literal rather than a reference	`error`

Cleartext card URL

The card, everything the CLI then exchanges with the agent it describes, and any auth header travel unencrypted. This is CFG049's threat model on a field that is not an MCP server. Loopback is silent: a card served by a local process is not an exposure.

Credential literals in `auth`

The block accepts apiKey (key, name), http (scheme + token, or username/password) and google-credentials (scopes). Gemini's docs use $VAR references throughout — but the zod schema is plain strings, so a committed literal is accepted and works.

cfgaudit checks the four credential-bearing fields (key, token, username, password) with the same literal test CFG065 uses, so $VAR references and obvious placeholders are not reported. scheme, name and scopes name a mechanism rather than a secret and are not checked.

What is not flagged

A https:// card URL on its own. Pointing at a remote agent is what the file is for; only the cleartext and the credential are findings.

An inline agent_card_json is decoded far enough to recognise the file as a remote agent, but its contents are not audited. Whether to apply the A2A checks (alg: none, HTTP endpoint, no auth declared) to an embedded card is the remainder of the scope question from #436.

Fix

---
kind: remote
name: helper
agent_card_url: https://agents.internal.example/.well-known/agent-card.json
auth:
  type: http
  scheme: Bearer
  token: $HELPER_AGENT_TOKEN
---

References

Gemini CLI — remote agents
CFG049 — the same cleartext threat for MCP servers
CFG065 — inline credential literals in a Continue config
OWASP LLM02:2026 – Sensitive Information Disclosure

Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation