Claude Code, Cursor, Copilot, Codex and Gemini CLI now run git, npm and shell commands for you, often in repos you cloned an hour ago. What those commands actually do is decided by a handful of config files: some in your home folder, some shipped inside the repo. Every item below has a published attack or advisory behind it.
For each one: what to look for, how to check by hand, and the source. At the end there is a free, open-source scanner that checks all of them at once.
1. Agent auto-approve settings
With auto-approve on, a prompt injection in a README or an issue becomes a command that runs without asking. A Copilot flaw (CVE-2025-53773) worked by switching chat.tools.autoApprove on.
Look for: chat.tools.autoApprove in VS Code or Cursor settings, Codex approval_policy = "never" or sandbox_mode = "danger-full-access", Gemini CLI folder trust turned off, Aider yes-always: true.
grep -n "autoApprove" ~/Library/Application\ Support/{Code,Cursor}/User/settings.json grep -nE "approval_policy|sandbox_mode" ~/.codex/config.toml 2. Claude Code hooks and project settings
Hooks run shell commands on events like starting a session. A .claude/settings.json committed to a repo can add hooks, auto-enable the repo's MCP servers, or point API traffic elsewhere with ANTHROPIC_BASE_URL. Check Point showed this leading to code execution and API token theft (CVE-2025-59536).
Look for: hooks that download and run code (curl … | sh), hooks that run a script from the repo, Bash(*) permission rules, and repo settings with ANTHROPIC_BASE_URL, apiKeyHelper or enableAllProjectMcpServers.
grep -nE "curl|wget|Bash\(\*\)" ~/.claude/settings.json find ~/code ~/projects -maxdepth 4 -path '*/.claude/settings.json' \ -exec grep -lE "ANTHROPIC_BASE_URL|apiKeyHelper|enableAllProjectMcpServers|hooks" {} + 3. MCP servers on unpinned packages
An MCP server started with npx -y some-package and no version can pick up a new release of that package without you noticing. If the package or its maintainer account is compromised, that release runs with your user's access. SafeDep found a malicious MCP package on npm that installed a macOS infostealer (SafeDep).
Look for: npx -y without an @version, and API keys written straight into a server's env, args or URL.
grep -n '"-y"' ~/.claude.json ~/.cursor/mcp.json 2>/dev/null 4. Git config that runs commands
A repo's own .git/config can name programs git runs on everyday commands: core.fsmonitor on every git status, core.pager on git log, filters on checkout. When an agent runs git status in a repo you just cloned, that program runs too (VulnCheck advisory; a nested bare repo variant in Copilot CLI GHSA-9ccr-r5hg-74gf).
# inside a repo git config --show-origin --get-regexp '^(core\.(fsmonitor|pager|editor|sshcommand)|filter\..*|alias\..*)' # every repo under ~/code find ~/code -maxdepth 4 -path '*/.git/config' -exec grep -lE 'fsmonitor|sshCommand|\[filter' {} + 5. Hidden text in agent rules files
AGENTS.md, CLAUDE.md, .cursorrules and Copilot instructions are read by the agent as instructions. Invisible Unicode (zero-width characters, bidirectional controls, tag characters) can carry instructions the agent follows but a reviewer never sees (Pillar Security, "Rules File Backdoor").
perl -CSD -ne 'print "$ARGV:$.\n" if /[\x{200B}-\x{200F}\x{202A}-\x{202E}\x{2066}-\x{2069}\x{E0000}-\x{E007F}]/; close ARGV if eof' \ AGENTS.md CLAUDE.md .cursorrules 2>/dev/null 6. Tokens in plain-text dotfiles
npm worms go straight for these files. Shai-Hulud 2.0 collected tokens from developer machines, including Google Cloud's application_default_credentials.json (Datadog); the malicious Nx releases did the same (Nx postmortem).
Look for: ~/.npmrc with _authToken=, ~/.git-credentials, ~/.pypirc, ~/.cargo/credentials.toml, ~/.netrc, AWS AKIA… keys in ~/.aws/credentials, and AI keys in project .env files. These commands count matches; they don't print the values.
grep -c "_authToken=" ~/.npmrc ls ~/.git-credentials ~/.pypirc ~/.netrc ~/.config/gcloud/application_default_credentials.json 2>/dev/null grep -c "AKIA" ~/.aws/credentials 7. Shell startup files and history
macOS stealers such as AMOS persist through shell startup files like .zshrc, which run every time a terminal opens (Hackread), and they search shell history for keys you once pasted on the command line (Wiz on the LiteLLM compromise).
grep -nE 'curl[^|]*\|[[:space:]]*(ba|z)?sh|base64 (-d|--decode)' ~/.zshrc ~/.zprofile ~/.zshenv ~/.bashrc 2>/dev/null grep -cE "(sk-|ghp_|AKIA|xox[bp]-)" ~/.zsh_history 8. Editor extensions and login items
Compromised extension releases have reached both marketplaces: Nx Console 18.95.0 shipped a credential stealer in May 2026 (StepSecurity) and the GlassWorm campaign on OpenVSX (Socket). Extensions installed from a local .vsix file skip marketplace checks entirely. Malware that gets in often stays through a LaunchAgent.
code --list-extensions --show-versions # compare against published reports grep -o '"source":"vsix"' ~/.vscode/extensions/extensions.json | wc -l ls -lt ~/Library/LaunchAgents # anything you don't recognise? Or check all of it in one command
Running those by hand across every editor and repo gets old. macflow-check is a free, MIT-licensed scanner that does it for you:
brew install mazharul/tap/macflow-check macflow-check 
It lists what to fix first, numbered, each with the fix and the file and line. Findings of the same kind collapse into one line; macflow-check --show 3 lists every finding in group 3, and --json gives machine-readable output. It also checks for known vulnerable or malicious packages in package-lock.json, Pipfile.lock and composer.lock via OSV, SSH config, outdated PHP, and reclaimable cache space.
What it doesn't do: it is read-only. It never changes a file, never runs a program it finds, and never prints a secret: findings name the file, line and kind of value only. The one network call sends lockfile package names, versions and ecosystems to OSV; --offline skips it. There is no telemetry.
Limitations: macOS only. It reads config files, not running processes or network traffic. Every check is a pattern for a known risky setting, so a config written to avoid those patterns will get past it. "No known match" means none of the checks matched, not that nothing is wrong.
The code, every rule and its source are on GitHub. Issues and PRs for new checks are welcome.
macflow-check is made by MacFlow, a Mac app that snapshots your dev setup and shows what changed. Continuous watching for these checks is planned.
