- block-curl-pipe-shbyopen-coder-ai
Best-effort guard: refuses a download (curl, wget, iwr; ssh host cmd, scp/rsync/aws s3 cp to stdout) wired into a shell…
- block-destructive-commandsbyopen-coder-ai
Best-effort, on parsed commands (echo ignored); one verdict table shared with rtk-dangerous-actions-blocker. Blocks…
- block-unapproved-egressbyopen-coder-ai
Best-effort guard on the tool channel: blocks sending data to a host outside the allowlist…
- protect-ci-workflowsbyopen-coder-ai
Asks a person before an agent weakens the checks that review its work. Shell guard refuses writes to…
- rtk-dangerous-actions-blockerbyopen-coder-ai
Deprecated: use block-destructive-commands, which shares this policy's destructive-command table. rtk#1007. Same table…
