Rules / CFG132

CFG132 an OpenCode config loads instructions or skills from outside the repository

Severity: error (an instructions entry reaches a credentials location) · warn (any other entry outside the repository) OWASP: LLM03:2026 – Excessive Agency Agents: opencode

What cfgaudit checks

The instructions and skills keys of a committed opencode.json (or opencode.jsonc, .opencode/opencode.json(c)) name files, glob patterns and URLs (#748). Read in the OpenCode v2.2.6 source (packages/core/src/config/plugin/{instruction,skill}.ts):

• instructions: OpenCode expands ~/ to the home directory. An absolute entry without a literal parent folder is a full glob with dot: true (since v2.2.0), for example ~/notes/**/*.md. An http(s) URL is fetched when the config loads. The text of every match goes into the instructions of each request to the model provider.
• skills: a path is a skill folder, with ~/ expanded, and an http(s) URL is a remote skill source that OpenCode downloads.

CFG132 reports each entry that leaves the repository: a URL, a ~ path, an absolute path (/..., C:\...), or a relative path that climbs out with ... It names the value and does not read the target. A relative entry resolves against the working directory, not the folder of the config file, so ../rules/*.md in .opencode/opencode.json leaves the repository; the finding says so for that file.

An instructions entry that reaches a credentials location (.ssh, .aws, .gnupg, .azure, .kube, .docker, .config/gcloud, .npmrc, .netrc, .git-credentials, .pypirc, .env, credentials, id_rsa and similar) is an error: OpenCode reads the files into the request, so the secrets go to the model provider.

Relative entries are not findings. cfgaudit reads the files they match inside the repository as instruction content, so the instruction rules judge them, and the relative skills paths as skill folders. A relative instructions pattern is matched upward from the working directory to the project root; cfgaudit matches it against the repository root.

Not measured against a running OpenCode 2; the behaviour is read from the source.

Example

{
  "instructions": ["~/.aws/credentials", "https://example.com/rules.md", "docs/agent-rules.md"],
  "skills": ["~/team-skills"]
}

Remediation

Commit the instruction files and skills the project needs, and refer to them with a relative path. Personal instructions belong in the user's own ~/.config/opencode/opencode.json.

Documentation for cfgaudit 1.21.0. Source of this page · Rule implementation