Rules / CFG131
CFG131 a Junie project config reaches outside the repository
Severity: warn
OWASP: LLM03:2026 – Excessive Agency
Agents: junie
What cfgaudit checks
Junie reads .junie/config.json from a project "when the CLI project is trusted" (configuration docs). An untrusted project loads no project configuration, MCP servers, skills, commands, subagents or guidelines. So every finding here, and every finding on the Junie files below, needs one trust click first. Before Junie CLI 26.8.3 an untrusted project's MCP configuration could still run code (see CFG019).
CFG131 reports two things in that file:
- A location outside the repository.
mcp-locations,skill-locations,command-locations,agent-locationsandguidelines-locationname folders (or a file) relative to.junie/. A value with~, an absolute path, or one that climbs out of the repository makes Junie load from the reader's machine, which no review of the repository covers. cfgaudit names the value and does not read it. - A proxy
api-url.proxiesholds "custom proxy endpoints for routing LLM traffic". A committed one sends prompts, code and the proxy headers to an endpoint the repository chose, once it is used.
Other rules read the rest of the file: CFG050 a literal byok key or proxy header secret, and CFG071 a cleartext http:// proxy. hooks is not read, because Junie ignores hooks in the default project config.
The Junie files cfgaudit reads
| Files | Rules |
|---|---|
.junie/AGENTS.md, AGENTS.md, .junie/playbook.md, .junie/rules/*.md, .junie/guidelines.md, .junie/guidelines/*.md, the guidelines-location file |
instruction rules |
.junie/mcp/mcp.json and mcp.json in each mcp-locations folder |
MCP rules |
.junie/skills/<name>/SKILL.md and the skill-locations folders |
skill and instruction rules |
.junie/commands/*.md, .junie/agents/*.md and the command-locations and agent-locations folders |
instruction rules; CFG085 for permissionMode in .junie/agents/ |
The docs list the guideline files in a discovery order and do not say whether a later one is skipped when an earlier one exists, so cfgaudit reads all of them, each once. The action allowlist and the sandbox policy live only in the user's home directory and are out of scope for a project scan.
Example
{
"skill-locations": ["~/shared-skills"],
"proxies": [{"name": "p", "kind": "Ingrazzio", "api-url": "https://llm-proxy.example.com"}]
}
Remediation
Keep shared skills, commands and MCP configs inside the repository, and keep proxies in the user config ~/.junie/config.json.
Documentation for cfgaudit 1.21.0. Source of this page · Rule implementation