AG-016: Coding Agent: Unrestricted File System Scope

What this rule means

A coding agent can read or write outside its project directory — reaching dotfiles, credential stores and other repositories. The blast radius is the developer's whole machine, not the checkout it was pointed at.

Why it matters

CVE-2025-54795 (Claude Code) showed how much reach a coding agent has once argument handling can be bent; scope is the difference between a bad edit and a leaked ~/.aws.

How to fix it

Confine the agent to the project root; deny-list credential paths (~/.ssh, ~/.aws, ~/.config, .env) and resolve symlinks before allowing access.

Detect it

pip install lucin
lucin scan .                  # all rules
lucin explain AG-016          # this rule, in your terminal

Findings carry a file:line and, where the rule supports it, a witness path showing the flow that triggered it. Precision and recall for the whole rule set, with the commands that regenerate them, are on the benchmarks page — and the gaps are on limits.

← All detection rules