Why It Matters

Wildcard tool grants make shared skills and instruction files much harder to review. Once frontmatter says every tool is allowed, the document stops expressing least privilege and becomes a much broader execution policy than most AI workflows actually need.

What Triggers

SEC355 applies to AI-native markdown surfaces with parsed frontmatter and triggers when any of these keys grants a literal wildcard tool token:

• allowed-tools
• allowed_tools
• tools

Examples that trigger:

• allowed-tools: "*"
• allowed_tools: ["*"]
• YAML list form with tools: followed by - "*"

Examples that stay clean:

• allowed-tools: Read, Write, Edit
• allowed-tools: Bash(git:*), Read
• files under fixture-like paths such as tests/fixtures/

False Positives

This rule now lives in the explicit guidance lane because some shared AI repos still document wildcard tool access as a convenience default. The rule is guidance about least privilege and reviewability, not a claim that every such file is immediately exploitable.

Remediation

Replace wildcard access with an explicit allowlist of only the tools the workflow actually needs. If a skill really needs shell access, prefer a narrower scoped form such as Bash(git:*) instead of *.

How To Pass Lint

Prefer frontmatter like this:

allowed-tools: Read, Write, Bash(git:*)

Avoid:

allowed-tools: "*"