[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CDNJ5FSTBTBWK4G4G8YGVW":3,"skill-same:01M6CDNJ5FSTBTBWK4G4G8YGVW":91},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":25,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":36,"commitSha":65,"skillDirectory":66,"forksCount":67,"repositoryHtmlUrl":68,"repositoryHomepageUrl":6,"ownerHtmlUrl":69,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":70,"install":71,"resources":84},"01M6CDNJ5FSTBTBWK4G4G8YGVW","ai-coding-agent-guardrails",null,"Secure AI coding agents (Claude Code, Cursor, Codex, Copilot) with permission boundaries, secret protection, code review gates, and safe sandbox configurations for team environments.","boisenoise\u002Fskills-collections","boisenoise","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F193180?v=4","01M6CDBDQK6BDN55ZMA6B6PKBM","01M6CDBDVSJ3JPTBYN26FZ7TZK",12,"MIT","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-ai-coding-agent-guardrails\u002FSKILL.md",[17,22],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000007","代码审查","SCENARIO","使用场景",{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",[26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"ai coding agent","coding agent","ai coding agent guardrails","ai coding","Guardrails","coding","team","relevant","scope","critical","main","community","review gates","agent-skills","only","code review","devops-security","license","code","assessment","secure","ai coding agents","copilot","security","safe","review","2026-11-10 10:12:30",false,"---\nname: ai-coding-agent-guardrails\ndescription: Secure AI coding agents (Claude Code, Cursor, Codex, Copilot) with permission\n  boundaries, secret protection, code review gates, and safe sandbox configurations\n  for team environments.\ncategory: security\nrisk: critical\nsource: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\nsource_repo: BagelHole\u002FDevOps-Security-Agent-Skills\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires the relevant security tooling (scanners, vault CLIs) and an\n  authorized scope for any active assessment. Docs-only; helper scripts and templates\n  not bundled.\nmetadata:\n  author: devops-skills\n  version: '1.0'\n---\n\n# AI Coding Agent Guardrails\n\nSecure the use of AI coding agents across engineering teams. This skill covers permission boundaries, secret protection, sandbox isolation, code review gates, and audit trails for Claude Code, Cursor, Copilot, and Codex.\n\n---\n\n## Permission Boundaries\n\n### CLAUDE.md Configuration\n\nA `CLAUDE.md` supplies behavioral guidance, not an OS sandbox. Merge compatible rules into existing instructions without overwriting them; tool permissions and isolation enforce boundaries independently.\n\n```markdown\n# CLAUDE.md\n\n## Restrictions\n\n- NEVER read or output contents of .env, .env.*, secrets.yaml, or any file matching *.pem, *.key\n- NEVER execute `rm -rf`, `DROP TABLE`, `kubectl delete`, or `terraform destroy` commands\n- NEVER push directly to main or master branches\n- NEVER modify files in the infrastructure\u002F, terraform\u002F, or .github\u002Fworkflows\u002F directories without explicit user approval\n- NEVER install new dependencies without listing them first for review\n- NEVER access or display API keys, tokens, passwords, or connection strings\n\n## Allowed Operations\n\n- Read and modify application source code in src\u002F, lib\u002F, and tests\u002F\n- Run test suites with `npm test`, `pytest`, `go test`\n- Run linters with `eslint`, `ruff`, `golangci-lint`\n- Create new branches with prefix `ai\u002F` or `agent\u002F`\n- Create and modify files in docs\u002F directory\n\n## Code Standards\n\n- All new functions must include docstrings or JSDoc comments\n- All new code must have corresponding unit tests\n- Follow existing code style and patterns in the repository\n- Maximum file length: 500 lines. Suggest splitting if exceeded.\n```\n\n### Command Allowlists\n\nFor agents that execute shell commands, define an explicit allowlist:\n\n```yaml\n# .agent-permissions.yaml — conceptual schema, not consumed automatically by these clients\nagent_permissions:\n  allowed_commands:\n    - \"npm test\"\n    - \"npm run lint\"\n    - \"npm run build\"\n    - \"pytest\"\n    - \"ruff check\"\n    - \"go test .\u002F...\"\n    - \"git status\"\n    - \"git diff\"\n    - \"git log\"\n    - \"git checkout -b\"\n    - \"git add\"\n    - \"git commit\"\n    - \"ls\"\n    - \"cat\"\n    - \"head\"\n    - \"tail\"\n\n  blocked_commands:\n    - \"rm -rf\"\n    - \"curl\"\n    - \"wget\"\n    - \"ssh\"\n    - \"scp\"\n    - \"kubectl\"\n    - \"terraform\"\n    - \"aws\"\n    - \"gcloud\"\n    - \"az\"\n    - \"docker push\"\n    - \"npm publish\"\n\n  blocked_paths:\n    - \".env*\"\n    - \"**\u002F*.pem\"\n    - \"**\u002F*.key\"\n    - \"**\u002Fsecrets\u002F**\"\n    - \"infrastructure\u002F**\"\n    - \".github\u002Fworkflows\u002F**\"\n\n  allowed_paths:\n    - \"src\u002F**\"\n    - \"lib\u002F**\"\n    - \"tests\u002F**\"\n    - \"docs\u002F**\"\n    - \"package.json\"\n    - \"pyproject.toml\"\n```\n\n### File System Access Controls\n\nLinux-only administrator sketch for a disposable checkout; do not recursively change ownership\u002Fmodes on a live developer repository. The script below grants named ACL entries but does not grant traversal on the repository\u002Fparent directories or default ACLs for new files. Design and verify both explicitly; prevent symlink escapes and keep credentials outside the sandbox. Recursive chmod 750 also marks source files executable.\n\nUse filesystem permissions to enforce boundaries at the OS level:\n\n```bash\n#!\u002Fbin\u002Fbash\n# setup-agent-workspace.sh\n# Create a restricted workspace for agent execution\n\nAGENT_USER=\"ai-agent\"\nREPO_DIR=\"\u002Fworkspace\u002Frepo\"\n\n# Create agent user with limited permissions\nuseradd --system --shell \u002Fbin\u002Fbash --no-create-home \"$AGENT_USER\"\n\n# Set ownership: developers own everything, agent gets read on most\nchown -R root:developers \"$REPO_DIR\"\nchmod -R 750 \"$REPO_DIR\"\n\n# Grant agent write access only to safe directories\nsetfacl -R -m u:${AGENT_USER}:rwx \"${REPO_DIR}\u002Fsrc\"\nsetfacl -R -m u:${AGENT_USER}:rwx \"${REPO_DIR}\u002Ftests\"\nsetfacl -R -m u:${AGENT_USER}:rwx \"${REPO_DIR}\u002Fdocs\"\n\n# Deny agent access to sensitive files\nsetfacl -m u:${AGENT_USER}:--- \"${REPO_DIR}\u002F.env\"\nsetfacl -R -m u:${AGENT_USER}:--- \"${REPO_DIR}\u002Finfrastructure\"\nsetfacl -R -m u:${AGENT_USER}:--- \"${REPO_DIR}\u002F.github\u002Fworkflows\"\n\necho \"Agent workspace permissions configured.\"\n```\n\n---\n\n## Secret Protection\n\n### Pre-commit Hooks with git-secrets\n\n```bash\n#!\u002Fbin\u002Fbash\n# install-secret-scanning.sh\n\n# Install git-secrets\ngit clone https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fgit-secrets.git \u002Ftmp\u002Fgit-secrets\ncd \u002Ftmp\u002Fgit-secrets && make install\n\n# Initialize in repository\ncd \u002Fpath\u002Fto\u002Frepo\ngit secrets --install\n\n# Register common secret patterns\ngit secrets --register-aws\n\n# Add custom patterns for common credential formats\ngit secrets --add '-----BEGIN (RSA |EC |DSA )?PRIVATE KEY-----'\ngit secrets --add 'AKIA[0-9A-Z]{16}'\ngit secrets --add 'ghp_[a-zA-Z0-9]{36}'\ngit secrets --add 'sk-[a-zA-Z0-9]{48}'\ngit secrets --add 'xox[baprs]-[0-9a-zA-Z-]{10,}'\ngit secrets --add 'password\\s*[:=]\\s*[\"\\x27][^\\s]{8,}'\ngit secrets --add 'api[_-]?key\\s*[:=]\\s*[\"\\x27][^\\s]{8,}'\n\n# Add allowed patterns (false positive exclusions)\ngit secrets --add --allowed 'EXAMPLE_KEY'\ngit secrets --add --allowed 'your-api-key-here'\n```\n\n### Agent Output Scanning\n\nScan agent-generated output before it reaches version control:\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"scan_agent_output.py - Scan AI agent output for leaked secrets.\"\"\"\n\nimport re\nimport sys\nfrom pathlib import Path\n\nSECRET_PATTERNS = [\n    (r'AKIA[0-9A-Z]{16}', 'AWS Access Key'),\n    (r'(?i)aws_secret_access_key\\s*[:=]\\s*\\S+', 'AWS Secret Key'),\n    (r'ghp_[a-zA-Z0-9]{36}', 'GitHub Personal Access Token'),\n    (r'gho_[a-zA-Z0-9]{36}', 'GitHub OAuth Token'),\n    (r'sk-[a-zA-Z0-9]{48,}', 'OpenAI\u002FAnthropic API Key'),\n    (r'xox[baprs]-[0-9a-zA-Z\\-]{10,}', 'Slack Token'),\n    (r'-----BEGIN (RSA |EC |DSA )?PRIVATE KEY-----', 'Private Key'),\n    (r'(?i)(password|passwd|pwd)\\s*[:=]\\s*[\"\\x27][^\\s]{4,}', 'Hardcoded Password'),\n    (r'(?i)(api[_-]?key|apikey)\\s*[:=]\\s*[\"\\x27][^\\s]{8,}', 'API Key'),\n    (r'eyJ[a-zA-Z0-9_-]{10,}\\.[a-zA-Z0-9_-]{10,}', 'JWT Token'),\n    (r'(?i)database_url\\s*[:=]\\s*\\S+', 'Database Connection String'),\n]\n\n\ndef scan_file(filepath: str) -> list[dict]:\n    findings = []\n    content = Path(filepath).read_text(errors=\"ignore\")\n    for line_num, line in enumerate(content.splitlines(), 1):\n        for pattern, label in SECRET_PATTERNS:\n            if re.search(pattern, line):\n                findings.append({\n                    \"file\": filepath,\n                    \"line\": line_num,\n                    \"type\": label,\n                    \"content\": \"[REDACTED]\",\n                })\n    return findings\n\n\ndef main():\n    files = sys.argv[1:]\n    if not files:\n        print(\"Usage: scan_agent_output.py \u003Cfile1> [file2] ...\")\n        sys.exit(1)\n\n    all_findings = []\n    for f in files:\n        all_findings.extend(scan_file(f))\n\n    if all_findings:\n        print(f\"BLOCKED: {len(all_findings)} potential secret(s) detected:\\n\")\n        for finding in all_findings:\n            print(f\"  [{finding['type']}] {finding['file']}:{finding['line']}\")\n            print(f\"    {finding['content']}\\n\")\n        sys.exit(1)\n\n    print(\"No matches in this bounded regex scan; this is not proof of absence.\")\n    sys.exit(0)\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\n### Git Pre-commit Hook Integration\n\n```bash\n#!\u002Fbin\u002Fbash\n# .git\u002Fhooks\u002Fpre-commit\n# Block commits containing secrets from AI agents\n\n# Use a maintained scanner that reads staged Git blobs, not working-tree paths.\n# A working-tree scan can miss a secret staged before a later local edit.\n# Require NUL-safe filename handling, bounded inputs and nonzero error status.\ngit secrets --pre_commit_hook -- \"$@\"\n# Integrate any additional scanner against the index through its documented API.\n```\n\n---\n\n## Sandbox Configuration\n\n### Docker Sandbox for Agent Execution\n\n```dockerfile\n# Dockerfile.agent-sandbox\nFROM ubuntu:24.04\n\nRUN apt-get update && apt-get install -y \\\n    git \\\n    nodejs \\\n    npm \\\n    python3 \\\n    python3-pip \\\n    && rm -rf \u002Fvar\u002Flib\u002Fapt\u002Flists\u002F*\n\n# Create non-root agent user\nRUN useradd -m -s \u002Fbin\u002Fbash agent && \\\n    mkdir -p \u002Fworkspace && \\\n    chown agent:agent \u002Fworkspace\n\n# Drop capabilities\nUSER agent\nWORKDIR \u002Fworkspace\n\n# No network by default - override at runtime if needed\n# No access to Docker socket\n# No access to host filesystem beyond mounted volume\n```\n\n```bash\n#!\u002Fbin\u002Fbash\n# run-agent-sandbox.sh\n# Launch an AI coding agent inside a locked-down container\n\nREPO_DIR=\"$(pwd)\"\nCONTAINER_NAME=\"agent-sandbox-$$\"\n\ndocker run \\\n  --name \"$CONTAINER_NAME\" \\\n  --rm \\\n  --network none \\\n  --read-only \\\n  --tmpfs \u002Ftmp:size=512m \\\n  --tmpfs \u002Fhome\u002Fagent:size=256m \\\n  --memory 4g \\\n  --cpus 2 \\\n  --pids-limit 256 \\\n  --security-opt no-new-privileges:true \\\n  --security-opt seccomp=seccomp-agent.json \\\n  --cap-drop ALL \\\n  -v \"${REPO_DIR}\u002Fsrc:\u002Fworkspace\u002Fsrc\" \\\n  -v \"${REPO_DIR}\u002Ftests:\u002Fworkspace\u002Ftests:rw\" \\\n  -v \"${REPO_DIR}\u002Fdocs:\u002Fworkspace\u002Fdocs:rw\" \\\n  -v \"${REPO_DIR}\u002Fpackage.json:\u002Fworkspace\u002Fpackage.json:ro\" \\\n  -e \"NO_COLOR=1\" \\\n  agent-sandbox:latest \\\n  \"$@\"\n```\n\n### Seccomp Profile for Agent Containers\n\nUntested illustrative syscall policy: architecture\u002Fruntime requirements differ and common calls may be missing. Prefer the runtime default until a tested custom profile is available. seccomp restricts syscalls, not paths; bind mounts, capabilities and user identity remain separate controls. USER alone does not drop capabilities; the runtime flags do. No-network containers also cannot reach cloud model APIs without a separately reviewed proxy design.\n\n```json\n{\n  \"defaultAction\": \"SCMP_ACT_ERRNO\",\n  \"comment\": \"seccomp-agent.json - Restrictive profile for AI coding agents\",\n  \"syscalls\": [\n    {\n      \"names\": [\n        \"read\", \"write\", \"open\", \"close\", \"stat\", \"fstat\", \"lstat\",\n        \"poll\", \"lseek\", \"mmap\", \"mprotect\", \"munmap\", \"brk\",\n        \"access\", \"pipe\", \"select\", \"sched_yield\", \"mremap\",\n        \"dup\", \"dup2\", \"nanosleep\", \"getpid\", \"getuid\", \"getgid\",\n        \"geteuid\", \"getegid\", \"getppid\", \"getpgrp\", \"setsid\",\n        \"getgroups\", \"uname\", \"fcntl\", \"flock\", \"fsync\",\n        \"getcwd\", \"chdir\", \"readlink\", \"chmod\", \"mkdir\",\n        \"rmdir\", \"unlink\", \"rename\", \"symlink\", \"readlinkat\",\n        \"openat\", \"mkdirat\", \"newfstatat\", \"unlinkat\", \"renameat\",\n        \"faccessat\", \"pselect6\", \"ppoll\", \"set_robust_list\",\n        \"get_robust_list\", \"epoll_create1\", \"epoll_ctl\", \"epoll_wait\",\n        \"eventfd2\", \"pipe2\", \"dup3\", \"pread64\", \"pwrite64\",\n        \"futex\", \"clock_gettime\", \"clock_getres\", \"exit_group\",\n        \"wait4\", \"clone\", \"execve\", \"arch_prctl\", \"set_tid_address\",\n        \"exit\", \"getdents64\", \"rt_sigaction\", \"rt_sigprocmask\",\n        \"rt_sigreturn\", \"ioctl\", \"writev\", \"madvise\", \"getrandom\"\n      ],\n      \"action\": \"SCMP_ACT_ALLOW\"\n    },\n    {\n      \"names\": [\n        \"socket\", \"connect\", \"bind\", \"listen\", \"accept\",\n        \"sendto\", \"recvfrom\", \"sendmsg\", \"recvmsg\"\n      ],\n      \"action\": \"SCMP_ACT_ERRNO\",\n      \"comment\": \"Block all network syscalls\"\n    },\n    {\n      \"names\": [\"ptrace\", \"process_vm_readv\", \"process_vm_writev\"],\n      \"action\": \"SCMP_ACT_ERRNO\",\n      \"comment\": \"Block debugging and process inspection\"\n    }\n  ]\n}\n```\n\n---\n\n\n## Contents\n\n- [Code Review Gates](references\u002Fdetails.md)\n- [Repository Configuration](references\u002Fdetails.md)\n- [Security Rules](references\u002Fdetails.md)\n- [File Restrictions](references\u002Fdetails.md)\n- [Code Quality](references\u002Fdetails.md)\n- [Git Behavior](references\u002Fdetails.md)\n- [Rules](references\u002Fdetails.md)\n- [Network Controls](references\u002Fdetails.md)\n- [Audit Trail](references\u002Fdetails.md)\n- [Team Policies](references\u002Fdetails.md)\n- [Testing Agent Output](references\u002Fdetails.md)\n- [Quick Reference](references\u002Fdetails.md)\n\n## When to Use\n\nApply these guardrails when:\n\n- Onboarding AI coding agents into an engineering team for the first time\n- Developers are using Claude Code, Cursor, Copilot, or Codex to generate production code\n- Agents have access to repositories containing secrets, infrastructure configs, or sensitive business logic\n- Your compliance framework (SOC 2, ISO 27001, FedRAMP) requires controls around automated code generation\n- Autonomous or semi-autonomous agents are creating pull requests without direct human typing\n- You need to enforce consistent security policies across multiple agents and team members\n\nSigns you need tighter guardrails:\n\n- Agents have committed secrets or credentials to version control\n- Agent-generated code has introduced vulnerabilities caught late in the pipeline\n- No clear audit trail distinguishes human-written from AI-generated code\n- Developers are bypassing code review for \"simple\" agent changes\n- Agents are executing arbitrary shell commands in production-connected environments\n\n---\n\n## Limitations\n\n- Apply guidance only within authorized scope; test destructive steps in non-production first.\n- Docs-only import: upstream scripts and templates not bundled.\n\n### Example\n\n```bash\n# Read-only first: inventory before any active step.\ncommand -v YOUR_REVIEWED_TOOL\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n","# AI Coding Agent Guardrails\n\nSecure the use of AI coding agents across engineering teams. This skill covers permission boundaries, secret protection, sandbox isolation, code review gates, and audit trails for Claude Code, Cursor, Copilot, and Codex.\n\n---\n\n## Permission Boundaries\n\n### CLAUDE.md Configuration\n\nA `CLAUDE.md` supplies behavioral guidance, not an OS sandbox. Merge compatible rules into existing instructions without overwriting them; tool permissions and isolation enforce boundaries independently.\n\n```markdown\n# CLAUDE.md\n\n## Restrictions\n\n- NEVER read or output contents of .env, .env.*, secrets.yaml, or any file matching *.pem, *.key\n- NEVER execute `rm -rf`, `DROP TABLE`, `kubectl delete`, or `terraform destroy` commands\n- NEVER push directly to main or master branches\n- NEVER modify files in the infrastructure\u002F, terraform\u002F, or .github\u002Fworkflows\u002F directories without explicit user approval\n- NEVER install new dependencies without listing them first for review\n- NEVER access or display API keys, tokens, passwords, or connection strings\n\n## Allowed Operations\n\n- Read and modify application source code in src\u002F, lib\u002F, and tests\u002F\n- Run test suites with `npm test`, `pytest`, `go test`\n- Run linters with `eslint`, `ruff`, `golangci-lint`\n- Create new branches with prefix `ai\u002F` or `agent\u002F`\n- Create and modify files in docs\u002F directory\n\n## Code Standards\n\n- All new functions must include docstrings or JSDoc comments\n- All new code must have corresponding unit tests\n- Follow existing code style and patterns in the repository\n- Maximum file length: 500 lines. Suggest splitting if exceeded.\n```\n\n### Command Allowlists\n\nFor agents that execute shell commands, define an explicit allowlist:\n\n```yaml\n# .agent-permissions.yaml — conceptual schema, not consumed automatically by these clients\nagent_permissions:\n  allowed_commands:\n    - \"npm test\"\n    - \"npm run lint\"\n    - \"npm run build\"\n    - \"pytest\"\n    - \"ruff check\"\n    - \"go test .\u002F...\"\n    - \"git status\"\n    - \"git diff\"\n    - \"git log\"\n    - \"git checkout -b\"\n    - \"git add\"\n    - \"git commit\"\n    - \"ls\"\n    - \"cat\"\n    - \"head\"\n    - \"tail\"\n\n  blocked_commands:\n    - \"rm -rf\"\n    - \"curl\"\n    - \"wget\"\n    - \"ssh\"\n    - \"scp\"\n    - \"kubectl\"\n    - \"terraform\"\n    - \"aws\"\n    - \"gcloud\"\n    - \"az\"\n    - \"docker push\"\n    - \"npm publish\"\n\n  blocked_paths:\n    - \".env*\"\n    - \"**\u002F*.pem\"\n    - \"**\u002F*.key\"\n    - \"**\u002Fsecrets\u002F**\"\n    - \"infrastructure\u002F**\"\n    - \".github\u002Fworkflows\u002F**\"\n\n  allowed_paths:\n    - \"src\u002F**\"\n    - \"lib\u002F**\"\n    - \"tests\u002F**\"\n    - \"docs\u002F**\"\n    - \"package.json\"\n    - \"pyproject.toml\"\n```\n\n### File System Access Controls\n\nLinux-only administrator sketch for a disposable checkout; do not recursively change ownership\u002Fmodes on a live developer repository. The script below grants named ACL entries but does not grant traversal on the repository\u002Fparent directories or default ACLs for new files. Design and verify both explicitly; prevent symlink escapes and keep credentials outside the sandbox. Recursive chmod 750 also marks source files executable.\n\nUse filesystem permissions to enforce boundaries at the OS level:\n\n```bash\n#!\u002Fbin\u002Fbash\n# setup-agent-workspace.sh\n# Create a restricted workspace for agent execution\n\nAGENT_USER=\"ai-agent\"\nREPO_DIR=\"\u002Fworkspace\u002Frepo\"\n\n# Create agent user with limited permissions\nuseradd --system --shell \u002Fbin\u002Fbash --no-create-home \"$AGENT_USER\"\n\n# Set ownership: developers own everything, agent gets read on most\nchown -R root:developers \"$REPO_DIR\"\nchmod -R 750 \"$REPO_DIR\"\n\n# Grant agent write access only to safe directories\nsetfacl -R -m u:${AGENT_USER}:rwx \"${REPO_DIR}\u002Fsrc\"\nsetfacl -R -m u:${AGENT_USER}:rwx \"${REPO_DIR}\u002Ftests\"\nsetfacl -R -m u:${AGENT_USER}:rwx \"${REPO_DIR}\u002Fdocs\"\n\n# Deny agent access to sensitive files\nsetfacl -m u:${AGENT_USER}:--- \"${REPO_DIR}\u002F.env\"\nsetfacl -R -m u:${AGENT_USER}:--- \"${REPO_DIR}\u002Finfrastructure\"\nsetfacl -R -m u:${AGENT_USER}:--- \"${REPO_DIR}\u002F.github\u002Fworkflows\"\n\necho \"Agent workspace permissions configured.\"\n```\n\n---\n\n## Secret Protection\n\n### Pre-commit Hooks with git-secrets\n\n```bash\n#!\u002Fbin\u002Fbash\n# install-secret-scanning.sh\n\n# Install git-secrets\ngit clone https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fgit-secrets.git \u002Ftmp\u002Fgit-secrets\ncd \u002Ftmp\u002Fgit-secrets && make install\n\n# Initialize in repository\ncd \u002Fpath\u002Fto\u002Frepo\ngit secrets --install\n\n# Register common secret patterns\ngit secrets --register-aws\n\n# Add custom patterns for common credential formats\ngit secrets --add '-----BEGIN (RSA |EC |DSA )?PRIVATE KEY-----'\ngit secrets --add 'AKIA[0-9A-Z]{16}'\ngit secrets --add 'ghp_[a-zA-Z0-9]{36}'\ngit secrets --add 'sk-[a-zA-Z0-9]{48}'\ngit secrets --add 'xox[baprs]-[0-9a-zA-Z-]{10,}'\ngit secrets --add 'password\\s*[:=]\\s*[\"\\x27][^\\s]{8,}'\ngit secrets --add 'api[_-]?key\\s*[:=]\\s*[\"\\x27][^\\s]{8,}'\n\n# Add allowed patterns (false positive exclusions)\ngit secrets --add --allowed 'EXAMPLE_KEY'\ngit secrets --add --allowed 'your-api-key-here'\n```\n\n### Agent Output Scanning\n\nScan agent-generated output before it reaches version control:\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"scan_agent_output.py - Scan AI agent output for leaked secrets.\"\"\"\n\nimport re\nimport sys\nfrom pathlib import Path\n\nSECRET_PATTERNS = [\n    (r'AKIA[0-9A-Z]{16}', 'AWS Access Key'),\n    (r'(?i)aws_secret_access_key\\s*[:=]\\s*\\S+', 'AWS Secret Key'),\n    (r'ghp_[a-zA-Z0-9]{36}', 'GitHub Personal Access Token'),\n    (r'gho_[a-zA-Z0-9]{36}', 'GitHub OAuth Token'),\n    (r'sk-[a-zA-Z0-9]{48,}', 'OpenAI\u002FAnthropic API Key'),\n    (r'xox[baprs]-[0-9a-zA-Z\\-]{10,}', 'Slack Token'),\n    (r'-----BEGIN (RSA |EC |DSA )?PRIVATE KEY-----', 'Private Key'),\n    (r'(?i)(password|passwd|pwd)\\s*[:=]\\s*[\"\\x27][^\\s]{4,}', 'Hardcoded Password'),\n    (r'(?i)(api[_-]?key|apikey)\\s*[:=]\\s*[\"\\x27][^\\s]{8,}', 'API Key'),\n    (r'eyJ[a-zA-Z0-9_-]{10,}\\.[a-zA-Z0-9_-]{10,}', 'JWT Token'),\n    (r'(?i)database_url\\s*[:=]\\s*\\S+', 'Database Connection String'),\n]\n\n\ndef scan_file(filepath: str) -> list[dict]:\n    findings = []\n    content = Path(filepath).read_text(errors=\"ignore\")\n    for line_num, line in enumerate(content.splitlines(), 1):\n        for pattern, label in SECRET_PATTERNS:\n            if re.search(pattern, line):\n                findings.append({\n                    \"file\": filepath,\n                    \"line\": line_num,\n                    \"type\": label,\n                    \"content\": \"[REDACTED]\",\n                })\n    return findings\n\n\ndef main():\n    files = sys.argv[1:]\n    if not files:\n        print(\"Usage: scan_agent_output.py \u003Cfile1> [file2] ...\")\n        sys.exit(1)\n\n    all_findings = []\n    for f in files:\n        all_findings.extend(scan_file(f))\n\n    if all_findings:\n        print(f\"BLOCKED: {len(all_findings)} potential secret(s) detected:\\n\")\n        for finding in all_findings:\n            print(f\"  [{finding['type']}] {finding['file']}:{finding['line']}\")\n            print(f\"    {finding['content']}\\n\")\n        sys.exit(1)\n\n    print(\"No matches in this bounded regex scan; this is not proof of absence.\")\n    sys.exit(0)\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\n### Git Pre-commit Hook Integration\n\n```bash\n#!\u002Fbin\u002Fbash\n# .git\u002Fhooks\u002Fpre-commit\n# Block commits containing secrets from AI agents\n\n# Use a maintained scanner that reads staged Git blobs, not working-tree paths.\n# A working-tree scan can miss a secret staged before a later local edit.\n# Require NUL-safe filename handling, bounded inputs and nonzero error status.\ngit secrets --pre_commit_hook -- \"$@\"\n# Integrate any additional scanner against the index through its documented API.\n```\n\n---\n\n## Sandbox Configuration\n\n### Docker Sandbox for Agent Execution\n\n```dockerfile\n# Dockerfile.agent-sandbox\nFROM ubuntu:24.04\n\nRUN apt-get update && apt-get install -y \\\n    git \\\n    nodejs \\\n    npm \\\n    python3 \\\n    python3-pip \\\n    && rm -rf \u002Fvar\u002Flib\u002Fapt\u002Flists\u002F*\n\n# Create non-root agent user\nRUN useradd -m -s \u002Fbin\u002Fbash agent && \\\n    mkdir -p \u002Fworkspace && \\\n    chown agent:agent \u002Fworkspace\n\n# Drop capabilities\nUSER agent\nWORKDIR \u002Fworkspace\n\n# No network by default - override at runtime if needed\n# No access to Docker socket\n# No access to host filesystem beyond mounted volume\n```\n\n```bash\n#!\u002Fbin\u002Fbash\n# run-agent-sandbox.sh\n# Launch an AI coding agent inside a locked-down container\n\nREPO_DIR=\"$(pwd)\"\nCONTAINER_NAME=\"agent-sandbox-$$\"\n\ndocker run \\\n  --name \"$CONTAINER_NAME\" \\\n  --rm \\\n  --network none \\\n  --read-only \\\n  --tmpfs \u002Ftmp:size=512m \\\n  --tmpfs \u002Fhome\u002Fagent:size=256m \\\n  --memory 4g \\\n  --cpus 2 \\\n  --pids-limit 256 \\\n  --security-opt no-new-privileges:true \\\n  --security-opt seccomp=seccomp-agent.json \\\n  --cap-drop ALL \\\n  -v \"${REPO_DIR}\u002Fsrc:\u002Fworkspace\u002Fsrc\" \\\n  -v \"${REPO_DIR}\u002Ftests:\u002Fworkspace\u002Ftests:rw\" \\\n  -v \"${REPO_DIR}\u002Fdocs:\u002Fworkspace\u002Fdocs:rw\" \\\n  -v \"${REPO_DIR}\u002Fpackage.json:\u002Fworkspace\u002Fpackage.json:ro\" \\\n  -e \"NO_COLOR=1\" \\\n  agent-sandbox:latest \\\n  \"$@\"\n```\n\n### Seccomp Profile for Agent Containers\n\nUntested illustrative syscall policy: architecture\u002Fruntime requirements differ and common calls may be missing. Prefer the runtime default until a tested custom profile is available. seccomp restricts syscalls, not paths; bind mounts, capabilities and user identity remain separate controls. USER alone does not drop capabilities; the runtime flags do. No-network containers also cannot reach cloud model APIs without a separately reviewed proxy design.\n\n```json\n{\n  \"defaultAction\": \"SCMP_ACT_ERRNO\",\n  \"comment\": \"seccomp-agent.json - Restrictive profile for AI coding agents\",\n  \"syscalls\": [\n    {\n      \"names\": [\n        \"read\", \"write\", \"open\", \"close\", \"stat\", \"fstat\", \"lstat\",\n        \"poll\", \"lseek\", \"mmap\", \"mprotect\", \"munmap\", \"brk\",\n        \"access\", \"pipe\", \"select\", \"sched_yield\", \"mremap\",\n        \"dup\", \"dup2\", \"nanosleep\", \"getpid\", \"getuid\", \"getgid\",\n        \"geteuid\", \"getegid\", \"getppid\", \"getpgrp\", \"setsid\",\n        \"getgroups\", \"uname\", \"fcntl\", \"flock\", \"fsync\",\n        \"getcwd\", \"chdir\", \"readlink\", \"chmod\", \"mkdir\",\n        \"rmdir\", \"unlink\", \"rename\", \"symlink\", \"readlinkat\",\n        \"openat\", \"mkdirat\", \"newfstatat\", \"unlinkat\", \"renameat\",\n        \"faccessat\", \"pselect6\", \"ppoll\", \"set_robust_list\",\n        \"get_robust_list\", \"epoll_create1\", \"epoll_ctl\", \"epoll_wait\",\n        \"eventfd2\", \"pipe2\", \"dup3\", \"pread64\", \"pwrite64\",\n        \"futex\", \"clock_gettime\", \"clock_getres\", \"exit_group\",\n        \"wait4\", \"clone\", \"execve\", \"arch_prctl\", \"set_tid_address\",\n        \"exit\", \"getdents64\", \"rt_sigaction\", \"rt_sigprocmask\",\n        \"rt_sigreturn\", \"ioctl\", \"writev\", \"madvise\", \"getrandom\"\n      ],\n      \"action\": \"SCMP_ACT_ALLOW\"\n    },\n    {\n      \"names\": [\n        \"socket\", \"connect\", \"bind\", \"listen\", \"accept\",\n        \"sendto\", \"recvfrom\", \"sendmsg\", \"recvmsg\"\n      ],\n      \"action\": \"SCMP_ACT_ERRNO\",\n      \"comment\": \"Block all network syscalls\"\n    },\n    {\n      \"names\": [\"ptrace\", \"process_vm_readv\", \"process_vm_writev\"],\n      \"action\": \"SCMP_ACT_ERRNO\",\n      \"comment\": \"Block debugging and process inspection\"\n    }\n  ]\n}\n```\n\n---\n\n\n## Contents\n\n- [Code Review Gates](references\u002Fdetails.md)\n- [Repository Configuration](references\u002Fdetails.md)\n- [Security Rules](references\u002Fdetails.md)\n- [File Restrictions](references\u002Fdetails.md)\n- [Code Quality](references\u002Fdetails.md)\n- [Git Behavior](references\u002Fdetails.md)\n- [Rules](references\u002Fdetails.md)\n- [Network Controls](references\u002Fdetails.md)\n- [Audit Trail](references\u002Fdetails.md)\n- [Team Policies](references\u002Fdetails.md)\n- [Testing Agent Output](references\u002Fdetails.md)\n- [Quick Reference](references\u002Fdetails.md)\n\n## When to Use\n\nApply these guardrails when:\n\n- Onboarding AI coding agents into an engineering team for the first time\n- Developers are using Claude Code, Cursor, Copilot, or Codex to generate production code\n- Agents have access to repositories containing secrets, infrastructure configs, or sensitive business logic\n- Your compliance framework (SOC 2, ISO 27001, FedRAMP) requires controls around automated code generation\n- Autonomous or semi-autonomous agents are creating pull requests without direct human typing\n- You need to enforce consistent security policies across multiple agents and team members\n\nSigns you need tighter guardrails:\n\n- Agents have committed secrets or credentials to version control\n- Agent-generated code has introduced vulnerabilities caught late in the pipeline\n- No clear audit trail distinguishes human-written from AI-generated code\n- Developers are bypassing code review for \"simple\" agent changes\n- Agents are executing arbitrary shell commands in production-connected environments\n\n---\n\n## Limitations\n\n- Apply guidance only within authorized scope; test destructive steps in non-production first.\n- Docs-only import: upstream scripts and templates not bundled.\n\n### Example\n\n```bash\n# Read-only first: inventory before any active step.\ncommand -v YOUR_REVIEWED_TOOL\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n",{"name":5,"risk":35,"source":57,"license":14,"category":49,"metadata":58,"date_added":61,"description":7,"source_repo":62,"source_type":37,"compatibility":63,"license_source":64},"https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills",{"author":59,"version":60},"devops-skills","1.0","2026-09-20","BagelHole\u002FDevOps-Security-Agent-Skills","Requires the relevant security tooling (scanners, vault CLIs) and an authorized scope for any active assessment. Docs-only; helper scripts and templates not bundled.","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE","e8c4cb5cbafb600fab08ffdf4b23359c9f608d9d","skills\u002Fantigravity-ai-coding-agent-guardrails",3,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections","https:\u002F\u002Fgithub.com\u002Fboisenoise","2026-11-11 14:20:43",{"source":8,"skillName":5,"commands":72,"prompt":82,"zipAvailable":83},[73,76,79],{"tool":74,"command":75},"npx","npx skills add boisenoise\u002Fskills-collections --skill ai-coding-agent-guardrails",{"tool":77,"command":78},"bunx","bunx skills add boisenoise\u002Fskills-collections --skill ai-coding-agent-guardrails",{"tool":80,"command":81},"pnpm","pnpm dlx skills add boisenoise\u002Fskills-collections --skill ai-coding-agent-guardrails","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-ai-coding-agent-guardrails\u002FSKILL.md",true,[85],{"path":86,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"references\u002Fdetails.md","REFERENCE","参考文档",23599,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-ai-coding-agent-guardrails\u002Freferences\u002Fdetails.md",[92,120,142,168,187,210],{"skillNo":93,"name":94,"nameZh":6,"description":95,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":96,"licenseFileUrl":97,"sourceHtmlUrl":98,"categories":99,"keywords":100,"publishedAt":52},"01M6WNH92BHVFXHGPDZCPJ0AG0","web-access","Use Treg for public web or platform data only when existing search, browser and connected tools cannot cover the task, with explicit cost and data boundaries.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FSKILL.md",[],[101,102,103,104,105,106,107,108,109,110,111,40,112,113,114,35,115,116,117,118,119],"web","access","web access","official","development","browser","search","data","Tools","read","fetch","youtube","free tools","platform","free","cover","normal","when","2026",{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":96,"licenseFileUrl":124,"sourceHtmlUrl":125,"categories":126,"keywords":128,"publishedAt":52},"01M6WNF9XAYAB2CZDDJBAKNM93","treg","Use the Treg CLI or MCP catalog to discover, price and call authorized external tools with team-scoped credentials and a user-approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FSKILL.md",[127],{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},[122,129,130,131,104,105,43,109,132,133,32,134,135,136,137,35,138,139,140,141,119],"MCP","cli","github","Budget","credentials","catalog","use","call","discover","external tools","with","scoped","blob",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":96,"licenseFileUrl":146,"sourceHtmlUrl":147,"categories":148,"keywords":154,"publishedAt":52},"01M6WN93MEAZ4E41DYAHJRPHQT","recruit","Turn a job description into an evidence-linked candidate shortlist through Treg, with job-related ranking and optional authorized business contact enrichment.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FSKILL.md",[149],{"categoryNo":150,"categoryName":151,"taxonomyType":152,"taxonomyTypeDesc":153},"01JBSEEDCAT000000000000038","人力资源","PROFESSION","适用职业",[144,131,104,43,155,156,157,158,159,160,35,161,162,163,139,164,165,166,167,141,122,119],"https","email","enrichment","business","evidence","phone","ranking","post","job description","for","person","candidate","reason",{"skillNo":169,"name":170,"nameZh":6,"description":171,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":96,"licenseFileUrl":172,"sourceHtmlUrl":173,"categories":174,"keywords":175,"publishedAt":52},"01M6WN8R5RXSMHM9B4D9FAFX42","rea-growth","Analyze a company’s public growth and content through Treg, distinguish observations from hypotheses, and produce an evidence-linked playbook within an approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FSKILL.md",[],[176,177,178,131,104,43,179,180,155,181,132,182,183,184,159,35,185,186,141,122,119],"growth","rea","rea growth","produce","content","playbook","marketing","analyze","public","observations","company",{"skillNo":188,"name":189,"nameZh":6,"description":190,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":96,"licenseFileUrl":191,"sourceHtmlUrl":192,"categories":193,"keywords":194,"publishedAt":52},"01M6WN2EVE3RQRGWAKBT4S7YT2","make-ugc","Create original AI UGC-style product videos through Treg: research hooks, approve a licensed presenter and voice, generate clips, add captions and report costs.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FSKILL.md",[],[195,196,131,197,104,198,43,199,200,201,202,203,35,204,205,206,207,208,209,141],"make","make ugc","research","create","Video","Captions","ads","short","hooks","head","style","niche","trending","talking-head","approve",{"skillNo":211,"name":212,"nameZh":6,"description":213,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":96,"licenseFileUrl":214,"sourceHtmlUrl":215,"categories":216,"keywords":217,"publishedAt":52},"01M6WN10ARAA63Y8K1YNGXJ2RM","lead-signals","Find and qualify public buying signals through Treg, rank fitting business accounts and optionally enrich authorized business contact information.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FSKILL.md",[],[218,219,220,131,104,43,221,222,158,223,224,35,225,226,227,228,229,230,231,141],"signals","lead","lead signals","how","find","ready","as","how to","qualify","people","information","enrich","changes","funding"]