SG-060: IDE Auto-Approval / YOLO

Severity: HIGH

autoApprove, runOn folderOpen, permission_mode bypass, --yolo, --dangerously-skip-permissions

Fires when

• A config toggle disables the confirmation prompt: chat.tools.autoApprove: true, MCP autoApprove: true, permission_mode: bypass, or trust: all.
• A VS Code task is set to runOn: folderOpen, executing on project open before any user prompt.
• A baked-in CLI permission-bypass flag (--dangerously-skip-permissions or --yolo) appears in a config/shell/hook/mcp file, not in markdown docs.

Related CVEs

• CVE-2025-53773

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.

Research

• https://embracethered.com/blog/posts/2025/github-copilot-remote-code-execution-via-prompt-injection/
• https://blog.trailofbits.com/2025/08/06/prompt-injection-engineering-for-attackers-exploiting-github-copilot/