{
  "schema_version": 1,
  "id": "code-safety",
  "track": "coding",
  "name": "Code Safety",
  "version": "0.0.5",
  "sha256": "05eb5231e4f5eaaefcbb907e0a727e9fc0319a520fcb8541e9bfddcf9b44edd4",
  "sha256_v1": "d6db4e1ea2699d273a4507d02199601a19e547c52fbff881ff525317fd8e87ba",
  "keyword": "advise",
  "word": "advisory",
  "says": "advisory only. It is skill text, and nothing stops a violation",
  "description": "trigger: secrets, eval/exec, unsanitized SQL, hallucinated dependencies. avoid: committing credentials, adding unverified packages, executing dynamic code. Install scan-secrets (commit, agent write) for secrets and verify-dependency-exists (opt-in; needs an allowlist) for dependencies. Advisory: eval/exec and SQL guidance; a gate decides only the non-literal slice (agentic-code-security code pack: Python eval/exec, SQL built from strings in Python and JS).",
  "misses": null,
  "where": [
    "text"
  ],
  "groups": [
    "safety-guidance"
  ],
  "eval_cases": 4,
  "eval_executed": 0,
  "latest": {
    "version": "0.0.5",
    "date": "2026-10-27",
    "change": "Title wording only (IR-F40): \"Code Safety Rule\" is now \"Code Safety\". The id, guard and tests are unchanged."
  },
  "agent_labels": {
    "claude-code": {
      "keyword": "advise",
      "says": "advisory only. It is skill text, and nothing stops a violation"
    },
    "cursor": {
      "keyword": "advise",
      "says": "advisory only. It is skill text, and nothing stops a violation"
    },
    "codex": {
      "keyword": "advise",
      "says": "advisory only. It is skill text, and nothing stops a violation"
    },
    "copilot": {
      "keyword": "advise",
      "says": "advisory only. It is skill text, and nothing stops a violation"
    },
    "devin": {
      "keyword": "advise",
      "says": "advisory only. It is skill text, and nothing stops a violation"
    },
    "grok": {
      "keyword": "ungraded",
      "says": "Not graded yet for Grok"
    },
    "goose": {
      "keyword": "ungraded",
      "says": "Not graded yet for goose"
    },
    "antigravity": {
      "keyword": "ungraded",
      "says": "Not graded yet for Antigravity"
    },
    "openhands": {
      "keyword": "ungraded",
      "says": "Not graded yet for OpenHands"
    },
    "kimi-code": {
      "keyword": "ungraded",
      "says": "Not graded yet for Kimi Code"
    },
    "factory-droid": {
      "keyword": "ungraded",
      "says": "Not graded yet for Factory Droid"
    }
  },
  "source_url": "https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/code-safety",
  "enforces": "advisory",
  "examples": []
}