SG-068: Permissions skip declared in config

Severity: CRITICAL

dangerouslySkipPermissions: true is the JSON form of --dangerously-skip-permissions. SG-060 catches the CLI flag; this catches it being baked into the project config where every contributor inherits the bypass without typing the flag.

Fires when

• The `dangerouslySkipPermissions` key is set to `true` in config - the JSON form of the --dangerously-skip-permissions flag.
• A variant permission-skip toggle (skipDangerousModePermissionPrompt / skipAutoPermissionPrompt / skipPermissionsPrompt) is set to `true`.
• A lifecycle hook's `command` includes `--dangerously-skip-permissions` or `--yolo`.

Related CVEs

• CVE-2025-53773

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.