SG-046: Multi-Doc YAML / JSON-in-YAML

Severity: HIGH

Multiple YAML documents in a single file, or YAML scalars that parse as JSON-with-directives.

Fires when

• The file has YAML frontmatter plus 3+ `---` separators and a second YAML document containing override-shaped keys (e.g. `override: true`, `permissionMode: bypassPermissions`, `allowed-tools: *`).
• A YAML scalar value itself parses as JSON containing directive-like text.

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.

Research

• https://yaml.org/spec/1.2.2/