valtik-ai-ide-config-guard

Scan a repository for AI-IDE configuration files that can trigger RCE, credential theft, or persistent compromise of developer machines when the repo is opened in Claude Code, Cursor, Windsurf, Continue, or any VS Code fork.

Built in response to the April 2026 AI-IDE disclosure wave:

• CVE-2025-59536 / CVE-2026-21852 — Claude Code settings.json SessionStart / PreToolUse / PostToolUse / UserPromptSubmit hooks execute arbitrary shell commands on workspace open.
• CVE-2026-30615 — Windsurf config-write RCE class.
• Pillar Security — Rules File Backdoor (2026) — Unicode-smuggled instructions inside .cursorrules / .windsurfrules / .github/copilot-instructions.md / .continue/*.md that hide attacker directives from a human reviewer.
• ANTHROPIC_BASE_URL / OPENAI_BASE_URL / OPENAI_API_BASE redirection to attacker-controlled endpoints (prompt + API-key exfiltration).
• MCP server auto-registration via mcp.json / .mcp.json / .cursor/mcp.json / .claude/mcp.json with arbitrary command stdio invocation.
• .vscode/tasks.json autorun on workspace open.

Run it on every third-party repo you clone before opening it in an AI-powered editor.

Install

No install — use npx:

npx valtik-ai-ide-config-guard <path>

Or install globally:

npm i -g valtik-ai-ide-config-guard
ai-ide-config-guard <path>

Node 20+ required.

Usage

$ npx valtik-ai-ide-config-guard ./my-cloned-repo

With a failure threshold (for CI):

$ npx valtik-ai-ide-config-guard . --fail-on high

JSON output:

$ npx valtik-ai-ide-config-guard . --json > report.json

SARIF 2.1.0 (for GitHub code scanning):

$ npx valtik-ai-ide-config-guard . --sarif > report.sarif

Run a subset of checks:

$ npx valtik-ai-ide-config-guard . --checks G1,G3,G5

Full flag list: npx valtik-ai-ide-config-guard --help.

Checks

G1 — Claude Code hook runs shell

Finds .claude/settings.json and parses hooks.SessionStart / hooks.PostToolUse / hooks.PreToolUse / hooks.UserPromptSubmit (and related lifecycle events). If any entry sets a command string (or type: "command" inside the grouped grammar), the finding is CRITICAL — opening the repo in Claude Code executes the command under the developer's shell with their env, SSH keys, and tokens.

G2 — Rules file Unicode smuggling

Scans .cursorrules, .cursor/rules/*.md[c], .windsurfrules, .windsurf/rules/*.md[c], .github/copilot-instructions.md, .continue/*.md for:

• Bidirectional override / embedding / isolate chars (U+202A–U+202E, U+2066–U+2069)
• Zero-width chars (U+200B, U+200C, U+200D, U+2060, U+FEFF, U+180E, U+00AD)
• Unicode tag block (U+E0000–U+E007F) — the invisible-to-humans token smuggling space
• Cyrillic homoglyphs (а/е/о/р/с/х/у/…) mixed inside otherwise-ASCII words
• Imperative role-override patterns (ignore previous, from now on, system:, etc.)

Pure-Cyrillic text, emoji, and BOMs at file start are ignored — we only flag what hides content from a human reviewer.

G3 — MCP auto-registration

Parses mcp.json, .mcp.json, .claude/mcp.json, .cursor/mcp.json, .windsurf/mcp.json, .vscode/mcp.json, .continue/config.json. For each registered server:

• command matches src/fixtures/known-malicious-mcp.json → CRITICAL
• command is a local binary → HIGH
• command is npx / uvx / pipx pulling an unverified package → MEDIUM
• url is non-https → MEDIUM
• url points to localhost / LAN → MEDIUM

G4 — VS Code tasks autorun

Flags any task with runOptions.runOn: "folderOpen". Severity escalates if the command uses shell interpolation (curl | sh, wget | bash, eval, base64 -d, backticks, $(...)) or references an external URL.

G5 — API base-URL redirection

Scans .env*, .claude/settings.json, .cursor/config.json, .vscode/settings.json, and any mcp.json for:

• ANTHROPIC_BASE_URL, ANTHROPIC_API_URL
• OPENAI_BASE_URL, OPENAI_API_BASE, OPENAI_API_URL

If the host is not the canonical vendor endpoint (api.anthropic.com / api.openai.com), the finding is CRITICAL — every request and API key goes to the attacker's endpoint. Non-cloud hosts (localhost, LAN IPs) are flagged HIGH.

G6 — Workspace trust

Flags .vscode/settings.json that ships with security.workspace.trust.enabled: false (or the Cursor analog), which silently opts out of the native gate that blocks autorun behavior.

G7 — Embedded shell in rules markdown

In rules .md / .mdc files, scans for fenced code blocks containing curl | sh, wget | bash, rm -rf, eval, base64 -d, python -c, /dev/tcp, reverse-shell mkfifo, chmod +x. Severity rises when the surrounding prose is imperative ("run this", "execute the following command").

G8 — package.json agent scripts

Informational flag for scripts named claude*, cursor*, windsurf*, mcp*, continue*, copilot*, aider*, cline*. HIGH if the same name collides with an npm lifecycle hook (preinstall, postinstall, etc.) — lifecycle hooks run on npm install with no user confirmation.

CI integration

GitHub Actions:

- name: AI-IDE config guard
  run: npx valtik-ai-ide-config-guard . --fail-on high

Or SARIF upload:

- run: npx valtik-ai-ide-config-guard . --sarif > ai-ide.sarif
- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: ai-ide.sarif

Limitations

• Static, signature-based, and conservative. Obfuscated payloads or novel vectors will be missed. Zero false positives on test/fixtures/safe/ is a design goal — we'd rather miss a borderline case than teach users to ignore us.
• Does not execute or resolve anything (no npx dry runs, no URL fetches).
• File reads are capped at 2 MB per file to prevent DoS.

References

• CVE-2025-59536 (Claude Code hooks)
• CVE-2026-21852 (Claude Code PostToolUse hooks)
• CVE-2026-30615 (Windsurf config-write RCE)
• Pillar Security — "Rules File Backdoor" (2026)
• Valtik Studios — AI-IDE Security 2026 (forthcoming)

Disclaimer

This tool is static analysis. A clean report means "the 8 checks shipped with this version did not fire", not "this repo is safe to open in an AI-IDE." Treat every repo you did not author as hostile and apply workspace-trust, hook review, and MCP review by hand.

MIT License — Copyright (c) 2026 Valtik Studios LLC.