Guides

Policies

Every catalog policy: what it does, its grade on each agent, what it misses, and an example.

Each policy in the pinned catalog has its own page. A grade is the catalog's own label for that agent.

Policies

Policy	Label	Status
Agent Discipline	advisory
Agentic Code Security	blocks
Block Agents Started With Safety Off	blocks
Block Curl Piped to Shell	blocks
Block Destructive Commands	blocks
Block Files That Skip Git Hooks	blocks
Block Invisible Unicode	blocks
Block Known-Malicious Packages	blocks
Block Persistence and Publishing Commands	blocks
Block Reading Stored Credentials	blocks
Block Risky Characters in File and Branch Names	blocks
Block Skipping Git Hooks	blocks
Block Test Skips	blocks
Block Unapproved Egress	blocks
Block Unpinned Agent Components	blocks
Block Unsafe Code Execution	blocks
Block Unsafe Package Registry Settings	blocks
Block Weakened Build Hardening	blocks
Block Wildcard Agent Permissions	blocks
Block Wildcard IAM Grants	blocks
CI GitHub Actions Security	blocks
Code Safety	advisory
Context Hygiene	advisory
Dependency Allowlist	blocks
Dockerfile and Compose Security	blocks
EU AI Act — High-Risk Triage	warns
EU AI Act — Prohibited Practices	advisory
EU AI Act — Transparency	advisory
Flag Dev Tools That Run Code on Open	warns
Flag Downloads Run as Code in Files	warns
Flag Hidden Binary Files in Tests	warns
Git Safety	advisory
Guard Deletion and Mitigation Removal	blocks
Guard Memory Writes	blocks
IAM Policy Scan	blocks
Injection Defense	advisory
Java Security Rules	blocks
Keep Accessibility From Regressing	blocks
Keep Changes Small Enough to Review	advisory
Lockfile Integrity	blocks
Match the Owner's Coding Style	advisory
Memory Discipline	advisory
OWASP ASI01 — Agent Goal Hijack	advisory
OWASP ASI02 — Tool Misuse & Exploitation	advisory
OWASP ASI03 — Identity & Privilege Abuse	advisory
OWASP ASI04 — Agentic Supply Chain Vulnerabilities	advisory
OWASP ASI05 — Unexpected Code Execution	advisory
OWASP ASI06 — Memory & Context Poisoning	advisory
OWASP ASI07 — Insecure Inter-Agent Communication	advisory
OWASP ASI08 — Cascading Failures	advisory
OWASP ASI09 — Human-Agent Trust Exploitation	advisory
OWASP ASI10 — Rogue Agents	advisory
Pin GitHub Actions	blocks
Protect Agent Config	blocks
Protect CI Workflows	asks
Protect Commit Privacy	blocks
Protect Main Branch	advisory
Protect Test Integrity	blocks
Review Added Scanner Suppressions	asks
Review Cloud Identity Switches	blocks
Review Like a Red Team	advisory
Review Scripts That Run on Install	blocks
Review Values That Look Like Secrets	asks
Scan Agent Permission Settings	blocks
Scan Hidden Content	warns
Scan Instruction Files	blocks
Scan Secret Files	blocks
Scan Secrets	blocks
Token Efficiency	advisory
Use Firecrawl Only as a Fallback	advisory
Verify MCP Allowlist	blocks

Built from engine 5a4b6287a46e and catalog 1e60d211c1bb.