Code Safety
Advisory only. It is skill text, and nothing stops a violation.
Acts on
Agent instructions
When
As instructions the agent reads
Tested
0 of 4 pass
In a git repo
Advisory
What it does
Trigger: secrets, eval/exec, unsanitized SQL, hallucinated dependencies. avoid: committing credentials, adding unverified packages, executing dynamic code. Install scan-secrets (commit, agent write) for secrets and verify-dependency-exists (opt-in; needs an allowlist) for dependencies. Advisory: eval/exec and SQL guidance; a gate decides only the non-literal slice (agentic-code-security code pack: Python eval/exec, SQL built from strings in Python and JS).
Chock adds friction. It is not a security boundary.
Its label on each agent
The catalog grades each policy on each agent. Pick an agent to build with this policy:
- Claude Code TestedAdvisory Advisory only. It is skill text, and nothing stops a violationBuild →
- Cursor TestedAdvisory Advisory only. It is skill text, and nothing stops a violationBuild →
- Codex TestedAdvisory Advisory only. It is skill text, and nothing stops a violationBuild →
- GitHub Copilot TestedAdvisory Advisory only. It is skill text, and nothing stops a violationBuild →
- Devin TestedAdvisory Advisory only. It is skill text, and nothing stops a violationBuild →
- Grok Tested Not graded yet for GrokBuild →
- goose Tested Not graded yet for gooseBuild →
- Antigravity Tested Not graded yet for AntigravityBuild →
- OpenHands Untested Not graded yet for OpenHandsBuild →
- Kimi Code Untested Not graded yet for Kimi CodeBuild →
- Factory Droid Untested Not graded yet for Factory DroidBuild →
What it misses
This policy does not state what it misses.
Latest change
0.0.5 · · Title wording only (IR-F40): "Code Safety Rule" is now "Code Safety". The id, guard and tests are unchanged.