Claude-assisted adapter code let OUROBOROS_CLI_PATH choose the executable handed to the Claude SDK. Once Ouroboros loaded a cloned project .env, that path became repository-controlled and could run attacker code.

+            cli_path: Path to the Claude CLI binary. If not provided,+                checks OUROBOROS_CLI_PATH env var, then falls back to+                SDK's bundled CLI.         """         self._permission_mode: str = permission_mode+        self._cli_path: Path | None = self._resolve_cli_path(cli_path)         log.info(             "claude_code_adapter.initialized",             permission_mode=permission_mode,+            cli_path=str(self._cli_path) if self._cli_path else None,+        )++    def _resolve_cli_path(self, cli_path: str | Path | None) -> Path | None:+        """Resolve the CLI path from parameter or environment variable.++        Args:+            cli_path: Explicit CLI path from constructor.++        Returns:

++        resolved = Path(path_str).expanduser().resolve()++        if not resolved.exists():+            log.warning(+                "claude_code_adapter.cli_path_not_found",+                cli_path=str(resolved),+            )+            return None++        if not resolved.is_file():+            log.warning(+                "claude_code_adapter.cli_path_not_file",+                cli_path=str(resolved),+            )+            return None++        log.debug(+            "claude_code_adapter.using_custom_cli",+            cli_path=str(resolved),         )+        return resolved      async def complete(         self,

-def _load_env_file(path: Path) -> None:+# Environment variables that determine HOW Ouroboros executes work. This+# is the single authoritative trust boundary: a cloned repository's `.env`+# must not be able to change which binary runs or whether the user's+# approval gate applies. Three classes, all remote-code-execution sinks+# when sourced from an untrusted location:+#   1. Explicit CLI path overrides fed straight into a subprocess.+#   2. Runtime/backend selectors that pick which adapter (and therefore+#      which executable) is spawned — a selector can route to a backend+#      whose CLI then resolves via a weak shutil.which / bare-name lookup.+#   3. Permission-mode overrides — setting acceptEdits/bypassPermissions+#      silently removes the human approval gate, letting a malicious repo+#      auto-approve arbitrary tool calls (effectively RCE).+# These keys are only honored from trusted sources (the real process+# environment, ~/.ouroboros/.env, ~/.ouroboros/config.yaml), never from+# the project-directory .env that travels with a cloned repo. Enforcing+# this here — at the .env load — keeps the policy in one place rather than+# split across downstream sinks.

+        "OUROBOROS_OPENCODE_CLI_PATH",+        "OUROBOROS_HERMES_CLI_PATH",+        "OUROBOROS_GOOSE_CLI_PATH",+        "OUROBOROS_GEMINI_CLI_PATH",+        # Bare provider aliases (no OUROBOROS_ prefix) that adapters also+        # honor and then execute. Any new such alias MUST be added here:+        # `opencode_config._configured_opencode_cli_path` reads+        # OPENCODE_CLI_PATH and runs it via subprocess.run.+        "OPENCODE_CLI_PATH",+        # Runtime/backend selectors — choose which adapter is spawned.+        "OUROBOROS_AGENT_RUNTIME",+        "OUROBOROS_RUNTIME",+        "OUROBOROS_LLM_BACKEND",+        # Permission-mode overrides — must not silently disable the+        # user's approval gate from an untrusted repo.+        "OUROBOROS_AGENT_PERMISSION_MODE",+        "OUROBOROS_LLM_PERMISSION_MODE",+        "OUROBOROS_OPENCODE_PERMISSION_MODE",+    }+)+++def _load_env_file(path: Path, *, trusted: bool = False) -> None:     if not path.is_file():         return @@ -136,6 +182,11 @@ def _load_env_file(path: Path) -> None:

+         parsed_value = _parse_env_value(raw_value)         if not parsed_value or _is_placeholder_api_key(parsed_value):             continue

-for env_path in (Path(".env"), Path.home() / ".ouroboros" / ".env"):-    _load_env_file(env_path)+# The project-directory .env travels with whatever repository the user+# cloned and is therefore untrusted; ~/.ouroboros/.env lives in the user's

 def ensure_config_dir() -> Path: