SG-067: Remote control at startup enabled

Severity: CRITICAL

remoteControlAtStartup: true on hooks or skills lets an external controller drive Claude Code from the moment a workspace opens. Combined with workspace auto-load, this is full silent RCE-equivalent.

Fires when

• The `remoteControlAtStartup` key is set to `true` on hooks or skills, letting an external controller drive the agent from the moment the workspace opens.

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.