cfgaudit

Rules / CFG116

CFG116 an instruction file imports a file from outside the repository

Severity: warn OWASP: LLM01:2026 – Prompt Injection

What cfgaudit checks

An @path import in a committed Claude Code instruction file that resolves outside the scanned repository:

The files checked are the ones whose imports Claude Code expands: CLAUDE.md, .claude/CLAUDE.md, AGENTS.md, .claude/AGENTS.md, .claude/rules/**, and every file they import inside the repository. CLAUDE.local.md is left out: it is the personal, usually gitignored file, and the memory docs suggest a home-directory import there to share preferences across worktrees.

cfgaudit does not read the imported file.

Why it matters

Claude Code loads an imported file into the same context as the file that imports it. An import that leaves the repository lets the repository choose which file on the reader's machine the agent reads as instructions, and nobody reviewing the repository can see what that file contains. @~/.aws/credentials puts a secret in front of a model that the rest of the context can tell to send it somewhere.

Claude Code guards this with a dialog: the first time a project has external imports, an interactive session lists the files and asks whether to load them, and the docs add "Never allow this for third-party repositories". Measured with 2.1.310, print mode (claude -p) does not load them. That is why this is warn: the finding makes sure the dialog is not the only thing between the repository and the file.

Imports that stay inside the repository are not reported. cfgaudit reads those files and runs the instruction-content rules on them, and their findings name the import chain, for example CLAUDE.md -> docs/notes.md.

Trigger example

# Project

Shared conventions: @~/.claude/team-conventions.md

Safe alternative

Commit the imported text into the repository and import it from there:

Shared conventions: @docs/conventions.md

For personal preferences, put the home-directory import into CLAUDE.local.md and keep that file out of the repository.

References

Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation