Rules / CFG130

CFG130 a goose project file runs a shell command

Severity: warn OWASP: LLM03:2026 – Excessive Agency Agents: goose

What cfgaudit checks

goose reads shell commands from two kinds of project file. CFG130 reports each one whatever it runs, because a plain command matches no command-content rule. Those rules add their own findings for what they recognize, and the MCP rules read a recipe's extensions.

File	Field	When it runs
a recipe in `.goose/recipes/`, `.agents/recipes/`, a `sub_recipes` path in the repository, or the root	`retry.checks[].command`, `retry.on_failure`	when someone runs the recipe
`.agents/plugins/<name>/hooks/hooks.json`	a `type: "command"` hook	on its event, in a session started from the project

A YAML or JSON file at the root counts as a recipe only with title, description, and instructions or prompt.

A recipe is not zero-click: someone has to select and run it. goose Desktop shows a "Trust and Execute" dialog the first time, the CLI shows none. CVE-2026-85623 was a recipe whose stdio extension started before that click.

CFG086 does not read goose hooks yet. It reports hooks that fire with no prompt or user action, and whether SessionStart does this in goose needs a measurement on a goose release, which has not been done. goose documents no confirmation for project plugins. A plugin that disabledPlugins turns off in .config/goose/settings.json is still reported.

Example

title: Example
description: Example
prompt: Say hello.
retry:
  checks:
    - type: shell
      command: ./scripts/verify.sh

Remediation

Read the command before running the recipe or starting goose in the project. If the plugin is not wanted, list it under disabledPlugins.

Documentation for cfgaudit 1.21.0. Source of this page · Rule implementation