rules-agent

AI agents can hallucinate dependencies. Pinning dependencies with hashes in requirements.txt is recommended to prevent typosquatting/malicious package execution.

Google Python Style Guide prohibits wildcard imports (import *). Please use explicit imports.

RISK: Jinja2 Environment with autoescape=False (or Template.from_string on LLM output) enables SSTI — the LangGrinch chain ends in Jinja2 RCE via trusted-namespace class instantiation. FIX: construct jinja2.Environment with autoescape=select_autoescape() and never render templates whose source string contains agent/user input.

RISK: child_process.exec or spawn with shell:true interpolates agent output into a shell string — command injection (CWE-78). FIX: use execFile/spawn with an explicit args array and shell:false; never concatenate agent-returned strings into shell commands.

RISK: eval() or new Function() on agent-generated strings enables arbitrary JavaScript execution (CWE-95). An LLM completing code or processing tool output can inject malicious expressions. FIX: never pass agent output directly to eval/new Function — use structured JSON parsing, sandboxed VMs, or purpose-built expression evaluators with a restricted scope.

RISK: LangChain CVE-2025-68664 (LangGrinch, CVSS 9.3) — dumps/loads with secrets_from_env=True allows prompt-injected LLM output to exfiltrate env-var secrets via unescaped 'lc' keys. FIX: upgrade langchain-core >= 0.3.81 (or >= 1.2.5) and pass secrets_from_env=False when deserializing untrusted payloads.

RISK: MCP tool descriptions containing hidden directives ('<IMPORTANT>', system-style comments, 'ignore previous instructions') are the canonical tool-poisoning vector (Invariant Labs 2025 — WhatsApp/GitHub MCP exfiltration). FIX: keep tool descriptions to plain user-visible prose and pin MCP server versions with integrity hashes so definitions can't mutate post-install.

Executing raw agent output via eval() or exec() leads to critical arbitrary code execution vulnerabilities.

Hardcoding API keys or secrets in agent scripts or outputs is a security risk. Use environment variables instead.

Using os.system or subprocess with shell=True with AI agent output can lead to command injection.

RISK: pickle/cloudpickle deserialization executes arbitrary code (CVE-2025-1716 bypasses picklescan; CVE-2026-0773 cloudpickle RCE; malicious models on Hugging Face routinely ship pickle payloads). FIX: load model weights via safetensors.load_file or torch.load(path, weights_only=True) on torch >= 2.6 (post CVE-2025-32434), never raw pickle on untrusted input.

Potential prompt injection vulnerability. Ensure user input is not directly interpolated into system prompts without escaping or bounding.

RISK: yaml.load / yaml.unsafe_load / Loader=yaml.Loader on agent-authored YAML allows arbitrary Python object construction and RCE via !!python/object tags. FIX: use yaml.safe_load() (or yaml.load(data, Loader=yaml.SafeLoader)) for all config, prompt, and tool-definition files.

RISK: agent-returned strings concatenated directly into file-system calls are a path traversal vector (CWE-22) — the LLM may return '../../../etc/passwd' or similar. FIX: resolve the path with path.resolve()/os.path.abspath(), then assert it starts with the expected base directory before any FS operation.

Writing a large reference table to a CLAUDE.md. These files are loaded into every conversation — duplicating tables across CLAUDE.md files wastes hundreds of tokens per conversation.

Hook script echoes on every allow decision. At ~10 tokens per tool call, this costs 500-1,500 tokens per session with no agent value — agents do not need confirmation that a tool was allowed.

Package installation modifies the environment. Confirm the package name is correct and the install is intentional — typosquatted package names are a common attack vector.

Writing a temporary or debug file to the repo root. These files are frequently committed by accident and clutter the working tree.

Sub-agent spawned. Each agent invocation consumes significant tokens. Prefer direct tools (Read, Grep, Glob, Edit) for focused lookups — reserve agents for tasks requiring multiple sequential decisions.

Background process started. Background jobs started by an agent are easy to lose track of — ensure cleanup is handled when the session ends.

Skill file written. Large SKILL.md files are injected entirely on each invocation — keep skills under 300 lines. Split into sub-skills or use lazy-loaded phase files for complex workflows.

Use the Read tool instead of 'cat' for reading files.

Use the Write tool instead of 'echo >' for writing file contents.

Use the Glob tool instead of 'find' for locating files by pattern.

Use the Grep tool instead of 'grep' or 'rg' for searching file contents.

Use the Read tool with offset/limit instead of 'head' or 'tail'.

Use the Edit tool instead of 'sed -i' for in-place file edits.