Review Like a Red Team
Advisory only. It is skill text, and nothing stops a violation.
Acts on
Agent instructions
When
As instructions the agent reads
Tested
0 of 16 pass
In a git repo
Advisory
What it does
Trigger: finishing or committing a diff that touches code, build or CI config, dependencies or agent config; a plan adding a handler, parser, auth path, crypto or sink; an ask-tier gate finding. Self-review of the diff in twelve red-team techniques, triaged by references/triage.json, reported as findings with exploit scenarios. Advisory: refuses nothing, writes no waiver, lowers no gate.
Chock adds friction. It is not a security boundary.
Its label on each agent
The catalog grades each policy on each agent. Pick an agent to build with this policy:
- Claude Code TestedAdvisory Advisory only. It is skill text, and nothing stops a violationBuild →
- Cursor TestedAdvisory Advisory only. It is skill text, and nothing stops a violationBuild →
- Codex TestedAdvisory Advisory only. It is skill text, and nothing stops a violationBuild →
- GitHub Copilot TestedAdvisory Advisory only. It is skill text, and nothing stops a violationBuild →
- Devin TestedAdvisory Advisory only. It is skill text, and nothing stops a violationBuild →
- Grok Tested Not graded yet for GrokBuild →
- goose Tested Not graded yet for gooseBuild →
- Antigravity Tested Not graded yet for AntigravityBuild →
- OpenHands Untested Not graded yet for OpenHandsBuild →
- Kimi Code Untested Not graded yet for Kimi CodeBuild →
- Factory Droid Untested Not graded yet for Factory DroidBuild →
What it misses
This policy does not state what it misses.
Latest change
0.0.1 · · Initial advisory companion skill (record 12 SK, plan D14): the twelve review techniques as a self-review over the diff, consuming ask-tier gate findings and the EP-17 triage table shipped as references/triage.json. No gate: it refuses nothing.