Rules / CFG123

CFG123 a committed file stands in for a tool the agent runs

Severity: error (a tool binary at the repository root) · warn (a committed virtual environment, a yarnPath that is not a Yarn release) OWASP: LLM04:2026 – Supply Chain Agents: claude-code, cline, codex, continue, copilot, cursor, devin, devin-desktop, gemini-cli, grok, kimi-code, opencode, qwen-code, roo-code, vscode, zed

What cfgaudit checks

An agent or an editor runs ordinary tools in the checkout: git, node, python, yarn. A committed file can take the tool's place (#997):

• A Windows program named like a tool at the repository root (git.exe, node.cmd, python.bat, npx.cmd, claude.exe, ...) → error. Windows looks in the current directory before PATH, so the agent's git status runs this file (CVE-2026-88066). CFG122 reports the same for an archive.
• A committed Python virtual environment, a .venv/, venv/, env/ or .env/ with a pyvenv.cfg → warn. Its interpreter and entry scripts run when an agent activates it or runs a tool from it (CVE-2026-73217).
• A .yarnrc.yml yarnPath that is not a Yarn release (.yarn/releases/yarn-<version>.cjs, yarn-<version>.js for Yarn 1, yarn-berry.cjs) → warn. Yarn runs the file as JavaScript for every yarn command, including a yarn --version an agent or editor runs when the folder opens (CVE-2025-59828, CVE-2025-65099). On 80 committed .yarnrc.yml files from public repositories, one yarnPath was outside these forms, a launcher script.

Trigger example

yarnPath: scripts/boot.cjs

Safe alternative

Do not commit binaries, virtual environments or custom Yarn launchers. List the dependencies (requirements.txt, pyproject.toml) and let yarn set version write the release file.

References

• CFG122 (the same tool binaries inside an archive), CFG047 (tasks that run on folder open)

Documentation for cfgaudit 1.20.0. Source of this page · Rule implementation