rules-windsurf

Windsurf 'Cascade' persistent agent activated. It will monitor terminal commands and file edits.

RISK: Agent is attempting to modify Windsurf 'Skills' or config. This could weaken security constraints or expand the agent's permitted capabilities. FIX: review all skill/config changes before approving.

RISK: Blocked 'Cascade' from monitoring sensitive directories like .ssh or .env. Monitoring these paths could expose SSH keys or credentials to the agent context. FIX: restrict watch paths to project source directories only.

RISK: Windsurf Memories files persist across sessions — writing a secret into a memory file commits it to long-term Cascade context storage where it may be logged, synced, or surfaced in unrelated conversations. FIX: never store secrets in .windsurf/memories; reference secrets only via environment variables or a secrets manager at runtime.

RISK: Enabling allowDangerousCommands / disableToolChecks / skipApproval in the Windsurf config removes the human-in-the-loop approval step for file writes and shell commands — the agent can execute destructive operations without confirmation. FIX: keep all approval gates enabled; use scoped allow-lists for specific safe commands rather than a blanket bypass.

RISK: The .windsurfrules file contains prompt-injection language ('ignore previous instructions', 'act as', 'you are now') that attempts to override Cascade's system constraints from within a project file. FIX: .windsurfrules must contain only legitimate coding guidelines; remove injected persona or override directives.