Check reference / Safety & Security
SAFETY-02 allowed-tools least-privilege
Deterministic — runs on every scan, no LLM or network needed.
Why it matters
A wildcard grant or bare `Bash` hands the artifact your entire toolbox — one prompt-injected instruction away from arbitrary shell commands running with your permissions. A subagent with no `tools` list is worse than it looks: it silently inherits every tool, including Bash.
How to fix it
List only the tools the work actually needs, and scope shell access to specific commands (`Bash(git status)`, `Bash(npm test)`). Never grant `*` or `all`; give every subagent an explicit `tools:` list.
Example
✗ flagged
allowed-tools: Bash✓ passes
allowed-tools: Read, Grep, Bash(git status)