Rules / CFG122

CFG122 an archive carries what a clone of the repository cannot

Severity: error (a .git entry, a tool binary at the root) · warn (links, which are not extracted) OWASP: LLM04:2026 – Supply Chain Agents: claude-code, cline, codex, continue, copilot, cursor, devin, devin-desktop, gemini-cli, grok, kimi-code, opencode, qwen-code, roo-code, vscode, zed

What cfgaudit checks

cfgaudit scans a .zip, .tar, .tar.gz or .tgz given as the scan target by unpacking it into a private temporary directory (#1002). Some attacks only arrive that way: a release archive can carry files that git clone never produces, so scanning a clone of the same repository misses what a user who downloads the archive gets. CFG122 reports, for an archive scan target only:

a .git file or directory at any depth → error. Unpacked, git treats the folder as a repository with the archive's own config and hooks, so an agent's next git call there runs what they name; a .git file can point git at another directory.
a Windows program named like a tool at the archive root (git.exe, node.cmd, python.bat, claude.exe, ...) → error. Windows looks in the current directory before PATH, so an agent or editor that starts the tool in the unpacked folder runs this file.
symbolic and hard links → warn. cfgaudit does not extract them, so the files they stand for were not scanned, and unpacked a link can point outside the folder.

Extraction

Entries are written only under the temporary directory: an absolute name, a drive letter or a .. component is not extracted, nor is an entry over 32 MiB or a second entry for the same path; stderr lists them. Links, devices and FIFOs are never created. The extraction stops at 50,000 entries or 512 MiB, and the directory is removed after the scan. Findings name paths inside the archive (skill.zip/scripts/setup.sh).

A git URL is not cloned: that would contact the network. Clone it yourself without hooks and filters, then scan the directory:

git -c core.hooksPath=/dev/null -c filter.lfs.smudge= -c filter.lfs.process= clone --depth 1 https://example.com/org/repo.git /tmp/repo
cfgaudit /tmp/repo

Trigger example

A release.zip with:

release.zip
├── .git/config
├── git.exe
└── AGENTS.md

Safe alternative

Get the source from the repository rather than from an archive that adds files to it, and unpack archives outside the folders an agent works in.

References

CFG121 (git metadata committed to a repository), CFG115 (committed symbolic links)

Documentation for cfgaudit 1.20.0. Source of this page · Rule implementation