Security: default GooseMode::Auto approves all tool calls with no policy gate (prompt-injection RCE)

Describe the bug

goose 1.52.0 defaults its permission mode to GooseMode::Auto ("Automatically approve tool calls"). When neither the GOOSE_MODE environment variable nor the config key is set, config.get_goose_mode() returns NotFound and unwrap_or_default() falls back to Auto, so a fresh install has no policy gate: PermissionInspector::inspect returns Allow unconditionally for the Auto branch (permission_inspector.rs:159-161) before any user-permission, read-only, or extension-management checks. The first-run setup (configure.rs) never prompts for or warns about the permission mode. Combined with the default-enabled, unsandboxed shell tool, attacker-controlled content processed by the agent can induce a shell tool call that executes on the host with no confirmation (prompt-injection-driven RCE).

To Reproduce

1. Install goose 1.52.0 and leave GOOSE_MODE unset (the default).
2. Prepare an instruction file that asks the agent to run a shell command that writes a marker file.
3. Control group: run GOOSE_MODE=approve goose run -i <file> --no-session — the run is refused non-interactively, no marker written.
4. Attack group: run goose run -i <file> --no-session with GOOSE_MODE unset — the command executes with zero confirmation and the marker is written.

Expected behavior

The default permission mode should fail closed (e.g. Approve/SmartApprove), and first-run setup should explicitly prompt for a mode and warn that Auto approves every tool call.

Technical advisory

n/a (CLI, no screenshots). Full technical write-up and the English proof-of-concept are published at:

• Advisory: https://github.com/ybyu-ieu/agent-security-advisories/blob/main/goose/goose-1.52.0-default-auto-mode-no-policy-gate.md
• PoC: https://github.com/ybyu-ieu/agent-security-advisories/blob/main/goose/goose-1.52.0-default-auto-mode-no-policy-gate-poc.py

Please provide the following information

• OS & Arch: Windows 11 x64 (cross-platform)
• Interface: CLI
• Version: v1.52.0
• Extensions enabled: developer (default)
• Provider & Model: DeepSeek (proof-of-concept); any provider applies

Additional context

Distinct from CVE-2026-72718 (the goose review git command) and CVE-2026-85623 (recipe extensions). A CVE ID has been requested through VulnCheck and is currently under review. Suggested remediation: move the #[default] off Auto, make an unset GOOSE_MODE fail closed instead of falling back to Auto, and prompt for a permission mode during first-run setup.

Do not begin implementation until the issue reaches Ready on the Goose Issues board.