AP003: Over-broad agent permission
| Severity | medium |
| Runs in | scan |
| One-line fix | Remove the blanket grant and allow only the specific commands or tools you need; keep approve-everything modes for throwaway containers or VMs. |
What it finds
Section titled “What it finds”A setting that lets an agent run any command, or skip its approval prompts, without asking you. Each agent module knows its own syntax. The table below shows what counts for each agent.
| Agent | Over-broad permission |
|---|---|
| Claude Code | Bash(*) and other blanket shell rules, bypassPermissions |
| Codex | approval never together with danger-full-access |
| Cursor | Shell(*), approvalMode: unrestricted |
| Gemini CLI | bare run_shell_command, a trusted MCP server |
| Windsurf | a command allow-list entry that approves any command (bash, an empty prefix) |
| OpenCode | permission set to "allow" for everything or for every shell command |
| GitHub Copilot | allow-all, VS Code chat.tools.global.autoApprove |
| Hermes Agent | approvals.mode: off, hooks_auto_accept |
| Antigravity | always-proceed, command(*) |
Why it matters
Section titled “Why it matters”With a blanket grant, one bad prompt or one poisoned file can make the agent run a command you never saw. That command runs with your full permissions.
How to fix
Section titled “How to fix”Remove the blanket grant. Allow only the specific commands or tools you need. Keep approve-everything modes for throwaway containers or virtual machines.
Limits
Section titled “Limits”- Only the settings in the table are checked. Other agents’ permission modes are not covered yet.
- Cursor’s IDE auto-run mode lives inside its
state.vscdbdatabase and is not read yet. - This is a medium print: a grant is a risk, not a leak.