Security floor
Every block rule and every warn = true rule across all 13 gates, on one page. The hard-deny floor fires regardless of settings.json; warn rules ask first but are marked dangerous-but-recoverable. The raw-string catalog runs against top-level commands and executable strings inside supported local shell wrappers, including shells invoked through xargs. Generated from rules/*.toml; authoritative for security review.
Raw-string floor · matched before parsing
rules/security.toml 34 patternspipe-bash hard-ask
Ask
Piping to bash runs whatever upstream returns, with no chance to inspect. Save the output to a file first, review it, then run.
pipe-sh hard-ask
Ask
Piping to sh runs whatever upstream returns, with no chance to inspect. Save the output to a file first, review it, then run.
pipe-zsh hard-ask
Ask
Piping to zsh runs whatever upstream returns, with no chance to inspect. Save the output to a file first, review it, then run.
pipe-sudo hard-ask
Ask
Piping to sudo elevates upstream output. Same risk as
curl | bash with full privileges; save and review the upstream content first.pipe-doas hard-ask
Ask
Piping to doas elevates upstream output. Same risk as
curl | bash with full privileges; save and review the upstream content first.pipe-python soft-ask
Ask
Piping to python runs upstream as a script. Save to a file first, review it, then run.
pipe-perl soft-ask
Ask
Piping to perl runs upstream as a script. Save to a file first, review it, then run.
pipe-ruby soft-ask
Ask
Piping to ruby runs upstream as a script. Save to a file first, review it, then run.
pipe-node soft-ask
Ask
Piping to node runs upstream as a script. Save to a file first, review it, then run.
eval hard-ask
Ask
eval runs arbitrary code constructed from variables. Prefer parameter expansion (${var}), array indexing, or case statements; if eval is truly needed, validate the input first.source soft-ask
Ask
source runs the file in the current shell and inherits its exports, aliases, and cds. Verify the file's contents before approving.dot-source soft-ask
Ask
. is equivalent to source: runs the file in the current shell and inherits its exports and aliases. Verify the file's contents before approving.xargs-rm soft-ask
Ask
xargs piping to
rm runs it once per input line. Verify the upstream filter; mistakes cascade.xargs-mv soft-ask
Ask
xargs piping to
mv runs it once per input line. Verify the upstream filter; mistakes cascade.xargs-cp soft-ask
Ask
xargs piping to
cp runs it once per input line. Verify the upstream filter; mistakes cascade.xargs-chmod soft-ask
Ask
xargs piping to
chmod runs it once per input line. Verify the upstream filter; mistakes cascade.xargs-chown soft-ask
Ask
xargs piping to
chown runs it once per input line. Verify the upstream filter; mistakes cascade.xargs-dd soft-ask
Ask
xargs piping to
dd runs it once per input line. Verify the upstream filter; mistakes cascade.xargs-shred soft-ask
Ask
xargs piping to
shred runs it once per input line. Verify the upstream filter; mistakes cascade.xargs-kubectl-delete soft-ask
Ask
xargs piping to
kubectl delete runs delete once per input line. Verify the upstream filter; mistakes cascade across many resources.find-delete soft-ask
Ask
find -delete removes every match. Run without -delete first to preview which paths would be removed.find-exec soft-ask
Ask
find -exec runs a command per match. Verify both the find filter and the command body; mistakes cascade across every match.find-fwrite soft-ask
Ask
find -fprintf/-fprint/-fls writes matched output to a file, overwriting it. Verify the target path.fd-exec soft-ask
Ask
fd executing
rm/mv/chmod/chown/dd/shred per match via -x/--exec. Verify the fd filter first (run without -x); mistakes cascade across every match.rg-exec hard-ask
Ask
ripgrep
--pre/--pre-glob/--hostname-bin run an external program (a per-file preprocessor or a hostname helper), i.e. arbitrary code execution. Run that program directly and inspect it first.sort-output soft-ask
Ask
sort -o/--output overwrites the target file without warning, and the target can be the input file itself. Verify the path.pg-dump-file soft-ask
Ask
pg_dump -f/--file writes the dump to a file and overwrites it. Omit -f to send the dump to stdout, or verify the path.gitleaks-report soft-ask
Ask
gitleaks -r/--report-path writes a report file to the given path, overwriting it. Verify the destination.unrar-extract soft-ask
Ask
unrar x/e extracts archive contents to disk and can overwrite files. Use unrar l to list without extracting, or verify the destination.net-mutate soft-ask
Ask
Network configuration change (
ip/route ... add|del|set, ifconfig ... up|down, arp -d|-s). Verify the interface and values; routing and interface changes can disrupt connectivity.dollar-subst hard-ask
Ask
$(...) command substitution contains a dangerous inner command (…). It runs and injects its output into the outer command, so the destructive call executes even when nested. Run it separately first, then use the literal result.backtick-subst hard-ask
Ask
Backtick substitution contains a dangerous inner command (
…). It runs and injects its output into the outer command, so the destructive call executes even when nested. Run it separately first, then use the literal result. Prefer $(...).leading-semicolon soft-ask
Ask
Command starts with
;. Usually a paste artifact or shell-injection attempt; review the full command before approving.redirect soft-ask
Ask
Output redirection (
>, >>, tee) writes to a file. Verify the target path; > overwrites without warning.Hard blocks · denied without prompting
rules/*.toml#block 49 patternscloudaws iam delete-user
Block
Blocked:
aws iam delete-user removes an IAM identity. Detach policies and rotate access keys via individual commands instead.cloudaws organizations delete
Block
Blocked:
aws organizations delete-* removes organization-level entities (accounts, OUs, policies). Effects span the whole org and are hard to reverse.cloudkubectl delete namespace kube-system
Block
Refusing to delete the
kube-system namespace. It hosts core cluster services; deleting it breaks the cluster.cloudkubectl delete ns kube-system
Block
Refusing to delete the
kube-system namespace. It hosts core cluster services; deleting it breaks the cluster.filesystemrm / /* ~/ ~/*
Block
rm against / or ~/ blocked: would recursively delete the system or home tree. No legitimate use in an agent workflow.filesystemrm -rf /
Block
rm -rf / blocked: would recursively delete the entire root filesystem.filesystemrm -rf /*
Block
rm -rf /* blocked: would recursively delete every top-level directory under root.filesystemrm -rf ~
Block
rm -rf ~ blocked: would recursively delete the user's home directory.filesystemrm -fr /
Block
rm -fr / blocked: would recursively delete the entire root filesystem.filesystemrm -fr ~
Block
rm -fr ~ blocked: would recursively delete the user's home directory.ghgh repo delete
Block
Deletes the repository on GitHub. Irreversible: history, issues, PRs, releases, and forks-from-this-repo are removed. Blocked unconditionally.
ghgh auth logout
Block
Logs out the gh CLI from GitHub. The agent has no way to re-authenticate without user interaction. Blocked unconditionally.
networknc -e
Block
netcat
-e blocked: connects a remote process to a shell on this host (classic reverse shell). No legitimate use in an agent workflow.systemchattr
Block
File attribute change blocked: agent has no authority to change extended file attributes. Misconfigured attributes can render files unmodifiable. Ask the user to run chattr themselves.
systemchsh
Block
Shell change blocked: agent has no authority to change a user's login shell. Ask the user to run chsh themselves.
systemdd
Block
Low-level disk operation blocked: agent has no authority to run raw block-device writes. The wrong destination overwrites a disk without warning. Ask the user to run dd themselves.
systemfdisk
Block
Disk partitioning blocked: agent has no authority to repartition disks. Mistakes here destroy data permanently. Ask the user to run partitioning themselves.
systemfirewall-cmd
Block
Firewall modification blocked: agent has no authority to modify firewall rules. Misconfigured rules can lock the user out of the system. Ask the user to run this themselves.
systemgdisk
Block
Disk partitioning blocked: agent has no authority to repartition disks. Mistakes here destroy data permanently. Ask the user to run partitioning themselves.
systemgrub-install
Block
Bootloader modification blocked: agent has no authority to modify the bootloader. A bad bootloader leaves the system unbootable. Ask the user to run this themselves.
systemhalt
Block
System power command blocked: agent has no authority to shut down or reboot the machine. If genuinely needed, ask the user to run this themselves.
systemhdparm
Block
Disk parameters blocked: agent has no authority to change disk-firmware parameters. Wrong values can brick drives. Ask the user to run hdparm themselves.
systeminit
Block
System power command blocked: agent has no authority to shut down or reboot the machine. If genuinely needed, ask the user to run this themselves.
systeminsmod
Block
Kernel module loading blocked: agent has no authority to load kernel modules. Module changes affect the entire running kernel. Ask the user to run this themselves.
systemiptables
Block
Firewall modification blocked: agent has no authority to modify firewall rules. Misconfigured rules can lock the user out of the system. Ask the user to run this themselves.
systemlvremove
Block
LVM management blocked: agent has no authority to remove physical volumes, volume groups, or logical volumes. Removal is irreversible and can destroy mounted filesystems on top of the LVM stack. Ask the user to run this themselves.
systemmke2fs
Block
Filesystem creation blocked: agent has no authority to format filesystems. The wrong target erases data permanently. Ask the user to run mke2fs themselves.
systemmkfs
Block
Disk partitioning blocked: agent has no authority to repartition disks. Mistakes here destroy data permanently. Ask the user to run partitioning themselves.
systemmkswap
Block
Swap creation blocked: agent has no authority to create swap areas on devices. The wrong target overwrites a device. Ask the user to run mkswap themselves.
systemmodprobe
Block
Kernel module loading blocked: agent has no authority to load kernel modules. Module changes affect the entire running kernel. Ask the user to run this themselves.
systemparted
Block
Disk partitioning blocked: agent has no authority to repartition disks. Mistakes here destroy data permanently. Ask the user to run partitioning themselves.
systempasswd
Block
Password change blocked: agent has no authority to change account passwords. Ask the user to run passwd themselves.
systempoweroff
Block
System power command blocked: agent has no authority to shut down or reboot the machine. If genuinely needed, ask the user to run this themselves.
systempvremove
Block
LVM management blocked: agent has no authority to remove physical volumes, volume groups, or logical volumes. Removal is irreversible and can destroy mounted filesystems on top of the LVM stack. Ask the user to run this themselves.
systemreboot
Block
System power command blocked: agent has no authority to shut down or reboot the machine. If genuinely needed, ask the user to run this themselves.
systemrmmod
Block
Kernel module removal blocked: agent has no authority to unload kernel modules. Removal can destabilize the running kernel. Ask the user to run this themselves.
systemshred
Block
Secure delete blocked: agent has no authority to wipe files irreversibly. Ask the user to run shred themselves.
systemshutdown
Block
System power command blocked: agent has no authority to shut down or reboot the machine. If genuinely needed, ask the user to run this themselves.
systemswapoff
Block
Swap management blocked: agent has no authority to enable or disable swap. Changes affect virtual memory behavior system-wide and can trigger OOM kills if swap is removed under load. Ask the user to run this themselves.
systemswapon
Block
Swap management blocked: agent has no authority to enable or disable swap. Changes affect virtual memory behavior system-wide and can trigger OOM kills if swap is removed under load. Ask the user to run this themselves.
systemufw
Block
Firewall modification blocked: agent has no authority to modify firewall rules. Misconfigured rules can lock the user out of the system. Ask the user to run this themselves.
systemumount
Block
Unmounting blocked: agent has no authority to unmount filesystems. Could disrupt running processes or system services depending on what's mounted. Ask the user to run umount themselves.
systemupdate-grub
Block
Bootloader modification blocked: agent has no authority to modify the bootloader. A bad bootloader leaves the system unbootable. Ask the user to run this themselves.
systemuseradd
Block
User management blocked: agent has no authority to create, delete, or modify user accounts. Account changes affect login and file ownership system-wide. Ask the user to run this themselves.
systemuserdel
Block
User management blocked: agent has no authority to create, delete, or modify user accounts. Account changes affect login and file ownership system-wide. Ask the user to run this themselves.
systemusermod
Block
User management blocked: agent has no authority to create, delete, or modify user accounts. Account changes affect login and file ownership system-wide. Ask the user to run this themselves.
systemvgremove
Block
LVM management blocked: agent has no authority to remove physical volumes, volume groups, or logical volumes. Removal is irreversible and can destroy mounted filesystems on top of the LVM stack. Ask the user to run this themselves.
systemwipe
Block
Secure wipe blocked: agent has no authority to wipe devices irreversibly. Ask the user to run wipe themselves.
systemwipefs
Block
Filesystem wipe blocked: agent has no authority to wipe filesystem signatures. The wrong target destroys the partition table. Ask the user to run wipefs themselves.
Warn rules · dangerous but recoverable
warn = true 5 patternsbeadsbd admin reset
Askwarn
Resets the beads database. Drops all issues, history, and local state. Cannot be undone without a backup or remote sync.
beadsbd reset
Askwarn
Resets the beads database. Drops all issues, history, and local state. Cannot be undone without a backup or remote sync.
gitgit push --force -f
Askwarn
Force push overwrites upstream history. Safer:
--force-with-lease fails if the remote moved.gitgit reset --hard
Askwarn
Hard reset discards uncommitted changes in the working tree and index. Safer:
git stash first, or git reset --soft to keep changes staged.gitgit clean -fd -fdx -f
Askwarn
Permanently deletes untracked files. Preview with
-n (dry run) first; deletions cannot be undone.