lintai docs

Appearance

Rule Reference

SEC421lintai-ai-securitygovernancehardeningpreviewmarkdownwarn

AI markdown: `Bash(git clone:*)` tool grant

AI-native markdown frontmatter grants `Bash(git clone:*)` authority

Public lane
governance
Category
hardening
Provider
lintai-ai-security
Scope
per-file
Surface
markdown
Tier
preview
Severity
warn
Confidence
high
Detection
structural
Remediation
message only
How to read this lane

Shared authority and workflow policy review.

How to read this category

Least-privilege, provenance, or operational hygiene signal.

Activation Model

Preset Activation

These presets explain where this rule appears in the product experience.

governancesidecar lane

Lifecycle

Stable Lifecycle Contract

State

stable

Graduation rationale

Checks AI-native frontmatter for wildcard git clone grants in shared allowed-tools policy.

Deterministic signal basis

MarkdownSignals exact frontmatter token detection for `Bash(git clone:*)` inside allowed-tools or allowed_tools.

Malicious corpus
skill-git-clone-allowed-tools
Benign corpus
skill-git-clone-allowed-tools-specific-safe
structured evidence required remediation reviewed
Canonical note

Structural preview rule; deterministic today, but the preview contract may still evolve.

Nearby Signals

Related Rules

SEC389AI markdown: bare WebSearch tool grantAI-native markdown frontmatter grants bare `WebSearch` tool accessgovernancehardeningmarkdown
SEC390AI markdown: shared git push tool grantAI-native markdown frontmatter grants `Bash(git push)` tool accessgovernancehardeningmarkdown
SEC391AI markdown: shared git checkout tool grantAI-native markdown frontmatter grants `Bash(git checkout:*)` tool accessgovernancehardeningmarkdown
SEC392AI markdown: shared git commit tool grantAI-native markdown frontmatter grants `Bash(git commit:*)` tool accessgovernancehardeningmarkdown
SEC393AI markdown: shared git stash tool grantAI-native markdown frontmatter grants `Bash(git stash:*)` tool accessgovernancehardeningmarkdown
SEC404AI markdown: bare WebFetch tool grantAI-native markdown frontmatter grants bare `WebFetch` tool accessgovernancehardeningmarkdown

SEC421 / MD-GIT-CLONE-ALLOWED-TOOLS ​

SEC421 flags AI-native markdown frontmatter when allowed-tools grants the exact token Bash(git clone:*).

Why It Matters ​

Blanket git clone authority turns arbitrary remote repository fetch into shared team policy. In AI-native instruction files, that makes broad code-ingestion behavior easier to normalize than a narrower reviewed fetch workflow.

Trigger Shape ​

The rule triggers only when all of these are true:

  • the file is an AI-native markdown instruction surface with parsed frontmatter
  • the path is not fixture-like
  • allowed-tools or allowed_tools contains the exact token Bash(git clone:*)

Clean Cases ​

These stay clean:

  • more specific reviewed commands such as Bash(git clone https://github.com/acme/demo.git)
  • frontmatter that does not grant git clone
  • fixture-like examples under test or fixture paths

Example Trigger ​

md
---
allowed-tools:
  - Bash(git clone:*)
  - Read
---

Safer Example ​

md
---
allowed-tools:
  - Bash(git clone https://github.com/acme/demo.git)
  - Read
---

How To Fix ​

Replace Bash(git clone:*) with a narrower reviewed command pattern, or remove broad clone authority from shared frontmatter entirely.