Skip to content

fix(guardian): deny unisolated interpreters in untrusted directories #1090

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
SamSaffron merged 1 commit into from
Aug 30, 2026
Merged

fix(guardian): deny unisolated interpreters in untrusted directories #1090

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions internal/guardian/policy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,8 @@ const DefaultPolicy = `## Environment Profile

### Code Execution and Supply Chain
- Installing packages, running package-manager scripts, executing downloaded code, or commands like curl|sh are at least medium risk and can be high risk if the source or purpose is unclear.
- Treat interpreter commands run with a downloaded or extracted working directory as high-risk untrusted code execution: local files can shadow standard-library or dependency imports even when the agent wrote the inline or script code.
- Deny unless the exact command uses isolation and a trusted working or script directory that exclude downloaded or extracted files from executable and import search paths.
- Prefer allow for common, user-requested local build/test/lint/format commands scoped to the current project.
- sudo, privilege escalation, background daemons, login items, cron/systemd/launchd changes, and persistent shell/profile modifications are high risk unless explicitly requested and narrowly scoped.

Expand Down
Loading