rules-common

Blocked 'dd' command which can overwrite entire disks or partitions.

Blocked dangerous 'rm' command with recursive or force flags without explicit user confirmation.

Blocked 'git push --force' to prevent rewriting history on shared branches.

Blocked 'git reset --hard' as it can result in uncommitted work loss.

Detected suspicious shell pipe to 'bash' or 'sh' which could execute remote scripts.

Blocked access to AWS credentials files.

Blocked access to browser profile directories which contain cookies and saved passwords.

Blocked direct reading of environment files which typically contain sensitive API keys and secrets.

Blocked modification of /etc/hosts which can be used for DNS spoofing or local traffic redirection.

Blocked modification of .git/config which can be used to set up malicious hooks or credential helpers.

Blocked access to Kubernetes configuration files.

Blocked modification of common system binaries to prevent backdoor insertion.

Blocked write to shell RC/profile file. Writing to .bashrc/.zshrc/.profile is a classic persistence mechanism — arbitrary commands added here execute every time a user logs in or opens a terminal (MITRE ATT&CK T1546.004). If you need to set an env var, make the change explicit and scoped.

Blocked modification of SSH config to prevent man-in-the-middle or credential exfiltration setups.

Blocked access to private SSH keys to prevent potential credential theft.

World-writable permission set (chmod 777 / a+w / o+w) detected. World-writable files are a common privilege escalation vector — any process on the system can overwrite them. Use the minimum permission needed (e.g., 755 for executables, 644 for data files).

Agent is attempting to modify crontab or scheduled jobs. This can be used for persistence.

Blocked direct deletion of cloud instances (EC2, Azure VM) via MCP.

Blocked dangerous database query (DROP, TRUNCATE) through MCP.

Blocked modification of database schema (ALTER TABLE) via MCP.

Blocked agent from stopping or removing Docker containers.

Blocked direct mutation of 'main' or 'master' branch via MCP.

Blocked unauthorized external HTTP requests through generic fetch/curl tools.

Blocked direct Jira issue deletion by the agent.

Agent is attempting to change cloud resource configurations.

Agent is attempting to DELETE records from a database.

Agent is attempting to delete a branch via MCP.

Agent is attempting to merge a pull request.

Agent is creating a GitHub Pull Request.

Agent is attempting to post message to Slack via MCP. This could result in internal data leaks.