AI config scan
AI coding assistants read a rules file - .cursorrules, copilot-instructions.md,
claude.md, agents.md, and their kin - and follow it. If an attacker (or a careless
commit) poisons that file, the assistant will happily exfiltrate secrets, disable a
security control, or install a package of the attacker's choosing. The AI config scan
treats these files as the injection surface they are.
When it runs
The AI config scan is one of the default engines on every repository / CI scan (alongside SAST, SCA, secrets, IaC and pipeline). There is nothing to enable - findings land in the normal Vulnerabilities store like any other.
What it scans
Only recognised AI-assistant files are inspected - the scan never flags on a filename alone, and it is tuned to stay silent on benign convention lines ("always write unit tests", "validate user input"):
- Instruction files:
.cursorrules,.windsurfrules,.clinerules,.aiderrules,copilot-instructions.md,claude.md,agents.md/agent.md,gemini.md,.aider.conf.yml. - Anything under an AI-config directory:
.cursor,.continue,.aider,.claude,.codeium,.windsurf,.clinerules,.roo,.gemini. - MCP config:
mcp.json,.mcp.json.
What it detects
Every rule is tagged CWE-1427 (prompt injection):
| Rule | Severity | What it catches |
|---|---|---|
| Instruction override | High | "Ignore all previous instructions…" - hijacking the assistant's directives |
| Disables a security control | High | Rules that tell the assistant to disable / skip / bypass auth, validation, a scanner or a gate |
| Secret exfiltration | Critical | Instructions to read and send .env, process.env, API keys or tokens |
| Remote code execution | Critical | curl | sh, base64 -d | bash, eval(atob(…)) and similar |
| Forced dependency (slopsquat vector) | Medium | "Always install package X" - a lever for slopsquat |
| Hidden Unicode | High | Invisible / steganographic characters used to smuggle instructions |
| Remote MCP server | Medium (CWE-829) | An MCP config wiring the agent to a remote, non-loopback tool endpoint |
MCP governance
Because the scan parses mcp.json / .mcp.json, it doubles as MCP governance: it
inventories the MCP servers your agents are configured to reach and flags any that point
at a remote service. Local stdio / localhost servers are treated as safe; a remote
endpoint is the "an agent is wired to an external tool surface nobody reviewed" concern,
so it is surfaced for review.
Reading the results
Each run reports the files scanned, how many AI-config files and injected-instruction findings were found, and a severity breakdown. Every finding carries the rule, the file and line, and a short evidence snippet. An inventory of every AI-instruction file and every MCP server (with its target and a remote flag) is produced alongside the findings.
The detectors run only inside recognised AI-instruction files and match on the malicious
content, not the file's existence. A repo that simply has a claude.md with normal
coding conventions produces no findings.