lintai docs

Appearance

Rule Reference

SEC425lintai-ai-securitygovernancehardeningstablemarkdownwarn

AI markdown: bare Edit tool grant

AI-native markdown frontmatter grants bare `Edit` tool access

Public lane
governance
Category
hardening
Provider
lintai-ai-security
Scope
per-file
Surface
markdown
Tier
stable
Severity
warn
Confidence
high
Detection
structural
Remediation
message only
How to read this lane

Shared authority and workflow policy review.

How to read this category

Least-privilege, provenance, or operational hygiene signal.

Activation Model

Preset Activation

These presets explain where this rule appears in the product experience.

governancesidecar lane

Lifecycle

Stable Lifecycle Contract

State

stable

Graduation rationale

Checks AI-native frontmatter for bare Edit grants that omit a reviewed repo-local scope.

Deterministic signal basis

MarkdownSignals exact frontmatter token detection for bare `Edit` inside allowed-tools or allowed_tools.

Malicious corpus
skill-unscoped-edit-allowed-tools
Benign corpus
skill-unscoped-edit-allowed-tools-specific-safe
structured evidence required remediation reviewed
Canonical note

Structural stable rule intended as a high-precision check with deterministic evidence.

Nearby Signals

Related Rules

SEC352AI markdown: unscoped Bash tool grantAI-native markdown frontmatter grants unscoped Bash tool accessgovernancehardeningmarkdown
SEC423AI markdown: bare Read tool grantAI-native markdown frontmatter grants bare `Read` tool accessgovernancehardeningmarkdown
SEC424AI markdown: bare Write tool grantAI-native markdown frontmatter grants bare `Write` tool accessgovernancehardeningmarkdown
SEC426AI markdown: bare Glob tool grantAI-native markdown frontmatter grants bare `Glob` tool accessgovernancehardeningmarkdown
SEC427AI markdown: bare Grep tool grantAI-native markdown frontmatter grants bare `Grep` tool accessgovernancehardeningmarkdown
SEC428AI markdown: unsafe Read path grantAI-native markdown frontmatter grants `Read(...)` over an unsafe repo-external pathgovernancehardeningmarkdown

SEC425 / MD-EDIT-UNSCOPED ​

SEC425 flags AI-native markdown frontmatter when allowed-tools or allowed_tools grants bare Edit.

This rule intentionally lives in the opt-in governance preset. Shared skills can legitimately edit files, but repo-wide default edit authority is a workflow-policy decision that deserves explicit review rather than headline security treatment.

Why It Matters ​

Bare Edit is a broad file-editing grant. In shared skills and instruction files, it makes open-ended content mutation part of the default team policy instead of a narrower reviewed edit scope.

Trigger Shape ​

  • AI-native markdown surface with parsed frontmatter
  • path is not fixture-like
  • allowed-tools or allowed_tools contains the exact token Edit

Clean Cases ​

  • scoped patterns such as Edit(./docs/**)
  • frontmatter that does not grant bare Edit
  • fixture-like examples under test or fixture paths

Example Trigger ​

md
---
allowed-tools: Edit, Read(./docs/**)
---

Safer Example ​

md
---
allowed-tools: Edit(./docs/**), Read(./docs/**)
---

How To Fix ​

Review whether shared bare Edit authority is really needed, or replace it with a narrower workflow-specific edit scope instead of a default repo-wide grant.