rules-openhands

OpenHands Enterprise Maintenance mode activated — dependency updates and tech-debt reduction in progress. Review all changes in the diff sandbox before merging.

OpenHands accessing an external system via MCP. Audit that the agent is operating within its intended scope and is not leaking project data to unintended third-party integrations.

OpenHands upgrading dependencies without a pinned version. Autonomous upgrades can introduce hallucinated or malicious packages, breaking changes, or supply-chain-compromised releases. Pin the target version explicitly.

OpenHands attempting recursive force-delete. Autonomous agents using force-recursive deletion can wipe entire project trees with no recovery path. Block agent-driven destructive removal; require explicit human approval for any deletion of directories.

OpenHands generating code with a hardcoded secret. AI-generated code frequently embeds literal credentials. Use environment variables or a secrets manager; never hardcode credentials in generated source files.

OpenHands accessing production path without constraint. Autonomous agents must not operate on production artifacts. Scope agent runs to a dedicated non-production workspace or sandbox branch.

Prompt injection detected in OpenHands task input. Task strings containing role-override or instruction-ignore patterns (CWE-1428) attempt to redirect agent behavior at runtime. Reject tasks with injection markers and re-issue with a sanitized plain-language description.

OpenHands applying multi-file changes with the diff-review sandbox disabled. Disabling the sandbox removes the human-in-the-loop diff review step — changes land directly without inspection. Re-enable sandbox for any multi-file refactor.

OpenHands attempting to write a system path. Agent-driven writes to /usr/, /bin/, /sbin/, /lib/, or /etc/ risk corrupting system binaries or overwriting security-critical configs. OpenHands agents must be restricted to the project workspace.