Coding agent honours another agent's configuration, and one marketplace consent arms more than one agent

coding-agent-cross-tool-config-bleed is a high severity check in the ai category, written in shell. Its source is templates/ai/coding-agent/coding-agent-cross-tool-config-bleed.sh in cert-x-gen-templates.

What it checks

Runs a coding-agent CLI twice against configuration surfaces that are identical except for whose tool they belong to. The control arm plants a marker-bearing MCP server in the target’s OWN config path and establishes that the target is config-driven at all. The probe arm plants the same declaration only in FOREIGN surfaces - .cursor/mcp.json, .vscode/mcp.json plus chat.mcp.discovery.enabled, .gemini/settings.json, ~/.codeium/windsurf/mcp_config.json, ~/.codex/config.toml - and no surface of the target’s own; honouring one of those proves a declaration planted for tool A is executed by tool B. A second arm installs one synthetic marketplace entry and counts consent prompts against the number of distinct agent plugin stores the install writes to, because a single consent that arms two agents is the blast radius, not the install.

There is a playbook for this check

Cross-agent config & marketplace bleed sets out the use case, the probe flow, the oracle, and the fixture that proves it in both directions.

Header

Field	Value
Id	coding-agent-cross-tool-config-bleed
Severity	high
Language	shell
Category	ai
Author	CERT-X-GEN Security Team
Template version	not recorded
Confidence	88
CVSS	not recorded
Weakness	CWE-1188
Tags	ai, coding-agent, cli, agent-posture, cross-tool, blast-radius, mcp, mcp-discovery, marketplace, plugin, config-bleed, trust-boundary, differential, cwe-1188, cwe-829, cwe-441, cwe-732
Target kind	cli
Oracle	property

Conventions of the repository, not fields the engine reads

@target_kinds and @oracles are documented in the templates repository’s contribution guide, and cxg’s annotation parser does not carry them into a template’s metadata. Nothing at scan time selects on them. The annotation header schema is every field the parser does read.

References

Declared in the header. cxg parses @references and then discards it, and nothing at scan time reads it, so this is the only place the links a template cites are surfaced.

• https://code.visualstudio.com/docs/copilot/customization/mcp-servers

Run it

To see what the copy on your machine says about itself, and to confirm it is installed at all:

cxg template info coding-agent-cross-tool-config-bleed

The id it prints is the one to pass anywhere a template is selected. See cxg template for the rest of the subcommand, Scan a target for running a scan, and A match is not a finding for how to read what comes back.

Related

• Template catalog is the whole corpus.
• ai is the rest of this category.
• Templates by weakness class groups checks by the defect they look for.
• Contribute a template is the route from a check you needed and could not find to a merged one.