coding_agents_rules.yaml

# Default ruleset for Prempti.
# Shipped with the project. Overwritten on upgrade.
# Users should add custom rules in the user/ directory instead of editing this file.
# Users can extend the lists below using Falco's override mechanism in user/ rules.
#
# File layout (sections):
#   1. Working-directory boundary
#   2. Sensitive paths
#   3. Sandbox disable
#   4. Threats — credentials, dangerous commands, exfiltration, supply chain
#   5. MCP and skill content
#   6. Persistence vectors
#
# Output convention:
#   The rule output is an LLM-friendly sentence that explains what happened and
#   why the verdict was applied. It must start with "Falco" to attribute the
#   verdict. Use resolved field values (%tool.real_file_path, %agent.real_cwd)
#   to make the message informative. Keep it clean — no structured key=value pairs.
#
#   correlation.id is a suggested output field (add_output in the plugin) and is
#   always included in output_fields. The catch-all seen rule (seen.yaml) includes
#   all fields for audit logging. Deny/ask rules only need the fields they reference.
#
#   The append_output config appends an AI agent instruction to every alert.
#   The broker constructs the verdict reason as: "Rule Name: <rendered message>".
#
#   Example reason seen by the coding agent:
#     Deny writing to sensitive paths: Falco blocked writing to /etc/passwd
#     because it is a sensitive path | For AI Agents: inform the user that
#     this action was flagged by a Falco rule | correlation=42
#
# Priority convention:
#   CRITICAL — deny verdict
#   WARNING  — ask verdict
#   NOTICE   — monitor only (no verdict tag)
#   DEBUG    — reserved for the catch-all seen rule (seen.yaml)

# ---------------------------------------------------------------------------
# Lists
# ---------------------------------------------------------------------------

- list: sensitive_paths
  items:
    - /etc/
    - /root/
    - /var/
    - /boot/
    - /proc/
    - /sys/

- list: sensitive_file_names
  items:
    - .env
    - .env.local
    - .env.production
    - .netrc
    - .npmrc
    - credentials.json
    - token.json

# Shell startup files that execute on every shell login.
- list: shell_startup_files
  items: [.bashrc, .zshrc, .profile, .bash_profile, .zprofile, .bash_login, .bash_logout]

# Agent instruction files that other coding agents read as prompt context.
- list: agent_instruction_files
  items: [.cursorrules, .windsurfrules, .aiderrules, AGENTS.md]

# Environment variable files commonly sourced by shells, frameworks, and CI.
- list: env_file_names
  items:
    - .env
    - .envrc
    - .env.local
    - .env.development
    - .env.production
    - .env.staging
    - .env.test
    - .env.ci
    - .env.override

# Package manager configuration files that control where packages are downloaded.
- list: registry_config_files
  items: [.npmrc, .pypirc, pip.conf, .pnpmrc, .yarnrc.yml]

# ---------------------------------------------------------------------------
# Macros — shared
# ---------------------------------------------------------------------------

# File-mutation detection across agents. Claude Code calls Write/Edit at the
# hook layer; Codex routes all file mutations through apply_patch, with the
# specific operation surfaced as tool.patch_op (one of Add/Update/Delete/Move).
# All four are destructive in the sense the default ruleset cares about: a
# rule denying writes to /etc/* should also deny `*** Delete File: /etc/*`,
# and an outside-cwd ask should fire equally for create, modify, delete, or
# rename. The macro intentionally treats them uniformly. Rules that need
# operation-level granularity can still pattern-match on tool.patch_op
# directly (e.g. `tool.patch_op = "Delete" and tool.real_file_path …`).
- macro: is_claude_write_tool
  condition: tool.name in ("Write", "Edit")

- macro: is_codex_patch_write
  condition: tool.name = "apply_patch" and tool.patch_op in ("Add", "Update", "Delete", "Move")

- macro: is_write_tool
  condition: is_claude_write_tool or is_codex_patch_write

# Extensible macro: each line is an "or" condition.
# Users can append custom sensitive paths via override:
#   - macro: is_sensitive_path
#     condition: or tool.real_file_path contains "/.my_secret_dir/"
#     override:
#       condition: append
- macro: is_sensitive_path
  condition: >
    tool.real_file_path pmatch (sensitive_paths)
    or tool.real_file_path contains "/.ssh/"
    or tool.real_file_path contains "/.gnupg/"
    or tool.real_file_path contains "/.aws/"
    or tool.real_file_path contains "/.azure/"
    or tool.real_file_path contains "/.config/gcloud/"
    or tool.real_file_path contains "/.kube/"
    or tool.real_file_path contains "/.docker/"
    or tool.file_name in (sensitive_file_names)
    or basename(tool.real_file_path) in (sensitive_file_names)

- macro: is_outside_cwd
  condition: >
    agent.real_cwd = ""
    or (tool.real_file_path != val(agent.real_cwd)
        and not tool.real_file_path startswith val(agent.real_cwd_prefix))

# Claude Code's own data tree (~/.claude/). The agent legitimately writes
# session bookkeeping here — plans, todos, memories, transcripts, caches,
# shell snapshots, file history, telemetry — and these writes are routine,
# not security-sensitive. This macro is intentionally broad: it suppresses
# the generic "outside working directory" ASK across the whole tree so the
# agent can manage its own state without prompting.
#
# Sensitive subpaths are guarded by independent rules that fire regardless
# of this suppression (verdict escalation: deny > ask > allow):
#   DENY   — settings.json, settings.local.json (hooks), policy-limits.json
#   ASK    — commands/, CLAUDE.md, agents/, skills/, plugins/, backups/
- macro: is_claude_data_path
  condition: tool.real_file_path contains "/.claude/"

# IOC hosting domains observed in the ClawHavoc campaign (341 malicious skills,
# 2024-2025) and similar AI-supply-chain attacks. Inlined into the macros below
# rather than a Falco list because Falco's condition language has no
# substring-match-against-list operator (only "in"/"pmatch", which require
# exact or prefix match — not what we need against a JSON blob or a Bash command).
# Extend by overriding the macros (condition: append) in user/ rules.
#
# Matches an IOC domain anywhere in the tool input JSON (Write/Edit content).
- macro: contains_ioc_domain
  condition: >
    tool.input contains "pastebin.com"
    or tool.input contains "transfer.sh"
    or tool.input contains "file.io"
    or tool.input contains "termbin.com"
    or tool.input contains "ix.io"
    or tool.input contains "glot.io"
    or tool.input contains "hastebin.com"
    or tool.input contains "ghostbin.co"

# Matches an IOC domain in a Bash command string.
- macro: cmd_contains_ioc_domain
  condition: >
    tool.input_command contains "pastebin.com"
    or tool.input_command contains "transfer.sh"
    or tool.input_command contains "file.io"
    or tool.input_command contains "termbin.com"
    or tool.input_command contains "ix.io"
    or tool.input_command contains "glot.io"
    or tool.input_command contains "hastebin.com"
    or tool.input_command contains "ghostbin.co"

# ===========================================================================
# Section 1 — Working-directory boundary
# ===========================================================================

- rule: Monitor activity outside working directory
  desc: >
    Logs when a coding agent reads, writes, or edits files outside the
    session's working directory. Informational only — does not block.
  condition: >
    tool.name in ("Write", "Edit", "Read")
    and tool.real_file_path != ""
    and is_outside_cwd
  output: >
    Falco detected access to %tool.real_file_path which is outside the working directory %agent.real_cwd
  priority: NOTICE
  source: coding_agent
  tags: []

- rule: Ask before writing outside working directory
  desc: >
    Requires user confirmation when a coding agent writes or edits a file
    outside the session's working directory. Claude Code's own data tree
    (~/.claude/) is excluded as routine session bookkeeping — plans,
    todos, memories, transcripts, caches. Sensitive subpaths under
    ~/.claude/ (settings.json, policy-limits.json, agents/, skills/,
    plugins/, backups/, commands/, CLAUDE.md) are still guarded by
    dedicated deny/ask rules.
  condition: >
    is_write_tool
    and tool.real_file_path != ""
    and is_outside_cwd
    and not is_sensitive_path
    and not is_claude_data_path
  output: >
    Falco requires confirmation to write to %tool.real_file_path because it is outside the working directory %agent.real_cwd
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask]

# ===========================================================================
# Section 2 — Sensitive paths
# ===========================================================================

- rule: Deny reading sensitive paths
  desc: >
    Blocks reads from sensitive filesystem locations such as ~/.ssh/,
    cloud credential directories, and environment variable files.
    Prevents exfiltration of secrets via the Read tool.
    Extend the sensitive_paths and sensitive_file_names lists in user/ rules
    to customize.
  condition: >
    tool.name = "Read"
    and is_sensitive_path
  output: >
    Falco blocked reading %tool.real_file_path because it is a sensitive path
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, mitre_t1552_unsecured_credentials]

- rule: Deny writing to sensitive paths
  desc: >
    Blocks writes to sensitive filesystem locations such as /etc/, ~/.ssh/,
    cloud credential directories, and environment variable files.
    Extend the sensitive_paths and sensitive_file_names lists in user/ rules
    to customize.
  condition: >
    is_write_tool
    and is_sensitive_path
  output: >
    Falco blocked writing to %tool.real_file_path because it is a sensitive path
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny]

# ===========================================================================
# Section 3 — Sandbox disable
# ===========================================================================
# Detects prompt injection attacks directing agents to disable their own
# OS-level sandbox isolation, and per-command sandbox escape requests.
#
# Coverage:
#   Rule A (ASK):   Agent writing sandbox-disable content to its own config file
#                   — Claude Code (sandbox.enabled: false/0/null in settings.json or
#                     settings.local.json), Codex (danger-full-access in config.toml),
#                     Gemini CLI (tools.sandbox: false/none/disabled in settings.json)
#                   ASK rather than DENY: the content macros (e.g., "enabled" + "false")
#                   match common JSON shapes that surface in unrelated settings.json
#                   edits via the Edit tool's old_string/new_string capture.
#   Rule B (ASK):   Claude Code per-command escape via dangerouslyDisableSandbox:true
#                   Bash tool parameter — the ONLY layer that can detect this
#                   since it is a tool call parameter invisible to Falco syscalls.
#   Rule C (DENY):  Bash command writing sandbox-disable content to an agent
#                   settings file — catches echo/python/tee/cat redirection that
#                   bypasses the Write/Edit tool check entirely.
#   Rule D (DENY):  Codex CLI startup sandbox bypass flags via Bash
#                   — --dangerously-bypass-approvals-and-sandbox (dash and underscore),
#                     --sandbox danger-full-access
#   Rule E (DENY):  GEMINI_SANDBOX environment variable set to a disabling value
#                   — none, false, disabled, 0
#   Rule F (DENY):  Bash command replacing an agent settings file via cp, mv, or
#                   sed -i — pre-crafted file placement or in-place edit with no
#                   disable keywords in the command itself
#
# Bypass techniques and the macros that close them:
#
#   Write/Edit tool (Rule A):
#     Edit value-only diff     "enabled":true→false without "sandbox" in diff
#                              → is_sandbox_disable_value_change ("enabled"+"false")
#     Numeric zero             "enabled": 0  JS falsy, not boolean false
#                              → is_sandbox_disable_value_zero ("enabled"+":0"/": 0")
#     Null value               "enabled": null  JS falsy
#                              → is_sandbox_disable_value_null ("enabled"+"null")
#     allowUnsandboxedCommands:1  numeric truthy, not string "true"
#                              → is_sandbox_allow_unsandboxed_numeric (":1"/": 1")
#     settings.local.json      same schema as settings.json, not in original path list
#                              → is_agent_sandbox_config extended
#     Gemini "none"/"disabled" string disable values, not boolean false
#                              → is_sandbox_disable_gemini_none/disabled
#
#   Bash tool (Rules C-F):
#     echo/tee/python write    Write/Edit rule never fires for Bash tool
#                              → Rule C: path check + content keywords
#     Python "False" (capital) python3 uses False, not false; bypasses lowercase check
#                              → is_bash_disable_sandbox_false_pyfalse
#     null in Bash command     echo '{"sandbox":{"enabled":null}}' > settings
#                              → is_bash_disable_sandbox_null
#     Bash enabled:0           echo '{"enabled":0}' > settings (no "false")
#                              → is_bash_disable_enabled_zero
#     allowUnsandboxedCommands:1 via Bash
#                              → is_bash_disable_allow_unsandboxed_numeric
#     sed -i settings          in-place edit; no sandbox/false keyword in sed cmd
#                              → Rule F: is_bash_settings_sed_write
#     cp/mv pre-crafted file   no disable keywords at all in cp/mv command
#                              → Rule F: is_bash_settings_cp / is_bash_settings_mv
#     Codex underscore flag    --dangerously_bypass_approvals_and_sandbox
#                              → is_codex_bypass_flag_underscore
#     GEMINI_SANDBOX=0         numeric zero not in original none/false/disabled list
#                              → is_gemini_env_zero
#     dangerouslyDisableSandbox:false  key-only check caused false positives
#                              → Rule B now requires both key + "true" value
#
# Known gaps (not detectable via tool call inspection):
#   - Unicode escapes in JSON keys: "sandbox" parses to "sandbox" at runtime
#     but tool.input contains a, not a. No decode step in Falco conditions.
#   - Variable indirection in Bash: SETTINGS=$HOME/.claude/settings.json
#     The variable name appears in the command, not the resolved path.
#   - Two-step attack (write to /tmp then cp): the /tmp write step is caught by the
#     tmp-staging rule in Section 4 before the cp step reaches Rule F.
#
# Official sandbox docs:
#   Claude Code : https://code.claude.com/docs/sandboxing
#   Codex       : https://developers.openai.com/codex/concepts/sandboxing
#   Gemini CLI  : https://geminicli.com/docs/cli/sandbox/

# Macros: file path matching

# Matches agent sandbox configuration file paths (canonicalized, absolute).
# Includes settings.local.json — same schema as settings.json, equal priority.
- macro: is_agent_sandbox_config
  condition: >
    tool.real_file_path endswith "/.claude/settings.json"
    or tool.real_file_path endswith "/.claude/settings.local.json"
    or tool.real_file_path endswith "/.codex/config.toml"
    or tool.real_file_path endswith "/.gemini/settings.json"

# Macros: Write/Edit content patterns (Rule A)

- macro: is_sandbox_disable_codex
  condition: tool.input contains "danger-full-access"

- macro: is_sandbox_disable_enabled_false
  condition: >
    tool.input contains "sandbox"
    and tool.input contains "false"

- macro: is_sandbox_toolsandboxing_false
  condition: >
    tool.input contains "toolSandboxing"
    and tool.input contains "false"

- macro: is_sandbox_allow_unsandboxed
  condition: >
    tool.input contains "allowUnsandboxedCommands"
    and tool.input contains "true"

# HARDENED: allowUnsandboxedCommands:1 — numeric truthy bypasses "true" check
- macro: is_sandbox_allow_unsandboxed_numeric
  condition: >
    tool.input contains "allowUnsandboxedCommands"
    and (tool.input contains ":1" or tool.input contains ": 1")

# HARDENED: Edit value-only diff — "sandbox" key absent from old/new strings
- macro: is_sandbox_disable_value_change
  condition: >
    tool.input contains "enabled"
    and tool.input contains "false"

# HARDENED: Numeric zero — JS evaluates enabled:0 as falsy
- macro: is_sandbox_disable_value_zero
  condition: >
    tool.input contains "enabled"
    and (tool.input contains ":0" or tool.input contains ": 0")

# HARDENED: Null value — JS evaluates enabled:null as falsy
- macro: is_sandbox_disable_value_null
  condition: >
    tool.input contains "enabled"
    and tool.input contains "null"

# HARDENED: Gemini string "none"
- macro: is_sandbox_disable_gemini_none
  condition: >
    tool.input contains "sandbox"
    and tool.input contains "none"

# HARDENED: Gemini string "disabled"
- macro: is_sandbox_disable_gemini_disabled
  condition: >
    tool.input contains "sandbox"
    and tool.input contains "disabled"

- macro: is_sandbox_disable_content
  condition: >
    is_sandbox_disable_codex
    or is_sandbox_disable_enabled_false
    or is_sandbox_toolsandboxing_false
    or is_sandbox_allow_unsandboxed
    or is_sandbox_allow_unsandboxed_numeric
    or is_sandbox_disable_value_change
    or is_sandbox_disable_value_zero
    or is_sandbox_disable_value_null
    or is_sandbox_disable_gemini_none
    or is_sandbox_disable_gemini_disabled

# Macros: Bash path matching (Rules C, F)

- macro: is_bash_sandbox_settings_path
  condition: >
    tool.input_command contains ".claude/settings.json"
    or tool.input_command contains ".claude/settings.local.json"
    or tool.input_command contains ".codex/config.toml"
    or tool.input_command contains ".gemini/settings.json"

# Macros: Bash content detection (Rule C)

- macro: is_bash_disable_codex
  condition: tool.input_command contains "danger-full-access"

- macro: is_bash_disable_sandbox_false
  condition: >
    tool.input_command contains "sandbox"
    and tool.input_command contains "false"

# HARDENED: Python uses capital False — bypasses lowercase "false" check
- macro: is_bash_disable_sandbox_false_pyfalse
  condition: >
    tool.input_command contains "sandbox"
    and tool.input_command contains "False"

# HARDENED: null in Bash-written content
- macro: is_bash_disable_sandbox_null
  condition: >
    tool.input_command contains "sandbox"
    and tool.input_command contains "null"

# HARDENED: numeric 0 for enabled field
- macro: is_bash_disable_enabled_zero
  condition: >
    tool.input_command contains "enabled"
    and (tool.input_command contains ":0" or tool.input_command contains ": 0")

- macro: is_bash_disable_toolsandboxing_false
  condition: >
    tool.input_command contains "toolSandboxing"
    and tool.input_command contains "false"

- macro: is_bash_disable_allow_unsandboxed
  condition: >
    tool.input_command contains "allowUnsandboxedCommands"
    and tool.input_command contains "true"

# HARDENED: allowUnsandboxedCommands:1 via Bash
- macro: is_bash_disable_allow_unsandboxed_numeric
  condition: >
    tool.input_command contains "allowUnsandboxedCommands"
    and (tool.input_command contains ":1" or tool.input_command contains ": 1")

- macro: is_bash_disable_sandbox_none
  condition: >
    tool.input_command contains "sandbox"
    and tool.input_command contains "none"

- macro: is_bash_disable_sandbox_disabled
  condition: >
    tool.input_command contains "sandbox"
    and tool.input_command contains "disabled"

- macro: is_bash_sandbox_disable_cmd
  condition: >
    is_bash_disable_codex
    or is_bash_disable_sandbox_false
    or is_bash_disable_sandbox_false_pyfalse
    or is_bash_disable_sandbox_null
    or is_bash_disable_enabled_zero
    or is_bash_disable_toolsandboxing_false
    or is_bash_disable_allow_unsandboxed
    or is_bash_disable_allow_unsandboxed_numeric
    or is_bash_disable_sandbox_none
    or is_bash_disable_sandbox_disabled

# Macros: Bash file replacement (Rule F)

# sed -i on a settings file — no disable keywords need to appear in the sed command
- macro: is_bash_settings_sed_write
  condition: >
    tool.input_command contains "sed"
    and tool.input_command contains "-i"
    and is_bash_sandbox_settings_path

# cp of any file onto a settings path — pre-crafted payload placement
- macro: is_bash_settings_cp
  condition: >
    tool.input_command contains "cp "
    and is_bash_sandbox_settings_path

# mv of any file onto a settings path
- macro: is_bash_settings_mv
  condition: >
    tool.input_command contains "mv "
    and is_bash_sandbox_settings_path

- macro: is_bash_sandbox_settings_replace
  condition: >
    is_bash_settings_sed_write
    or is_bash_settings_cp
    or is_bash_settings_mv

# Macros: Codex CLI bypass flags (Rule D)

- macro: is_codex_bypass_flag
  condition: tool.input_command contains "dangerously-bypass-approvals-and-sandbox"

# HARDENED: underscore variant — some CLI parsers normalize dashes to underscores
- macro: is_codex_bypass_flag_underscore
  condition: tool.input_command contains "dangerously_bypass_approvals_and_sandbox"

- macro: is_codex_danger_flag
  condition: >
    tool.input_command contains "codex"
    and tool.input_command contains "danger-full-access"

- macro: is_codex_sandbox_bypass
  condition: >
    is_codex_bypass_flag
    or is_codex_bypass_flag_underscore
    or is_codex_danger_flag

# Macros: GEMINI_SANDBOX env var bypass (Rule E)

- macro: is_gemini_env_none
  condition: >
    tool.input_command contains "GEMINI_SANDBOX"
    and tool.input_command contains "none"

- macro: is_gemini_env_false
  condition: >
    tool.input_command contains "GEMINI_SANDBOX"
    and tool.input_command contains "false"

- macro: is_gemini_env_disabled
  condition: >
    tool.input_command contains "GEMINI_SANDBOX"
    and tool.input_command contains "disabled"

# HARDENED: numeric 0
- macro: is_gemini_env_zero
  condition: >
    tool.input_command contains "GEMINI_SANDBOX"
    and (tool.input_command contains "=0" or tool.input_command contains "= 0")

- macro: is_gemini_sandbox_env_bypass
  condition: >
    is_gemini_env_none
    or is_gemini_env_false
    or is_gemini_env_disabled
    or is_gemini_env_zero

# Rules

- rule: Ask before agent writing sandbox-disable configuration
  desc: >
    Requires user confirmation when a coding agent writes or edits its own
    sandbox configuration file with content that may disable OS-level process
    isolation. Covers Edit value-only diffs, numeric/null falsy values,
    allowUnsandboxedCommands:1, Gemini string disable variants, and
    settings.local.json. Fires at PreToolUse, before the write executes.
    Asks rather than denies because the content macros (e.g., "enabled" +
    "false") match common JSON shapes that legitimately appear in unrelated
    settings.json edits — particularly when the Edit tool surfaces an
    existing disable-shape value in old_string/new_string.
  condition: >
    is_write_tool
    and tool.real_file_path != ""
    and is_agent_sandbox_config
    and is_sandbox_disable_content
  output: >
    Falco requires confirmation before %agent.name modifies its sandbox configuration at %tool.real_file_path
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, AML.T0054_llm_jailbreak, AML.T0051_llm_prompt_injection,
         mitre_t1562.001_impair_defenses_disable_or_modify_tools]

- rule: Ask before Claude Code per-command sandbox escape
  desc: >
    Requires user confirmation when Claude Code invokes the Bash tool with
    dangerouslyDisableSandbox set to true. Hardened to check both the key name
    and the "true" value — dangerouslyDisableSandbox:false no longer triggers a
    false positive ask. This rule is the ONLY detection layer for this event.
  condition: >
    tool.name = "Bash"
    and tool.input contains "dangerouslyDisableSandbox"
    and tool.input contains "true"
  output: >
    Falco requires confirmation before Claude Code runs an unsandboxed Bash command (%tool.input_command)
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, AML.T0054_llm_jailbreak, AML.T0051_llm_prompt_injection,
         mitre_t1562.001_impair_defenses_disable_or_modify_tools]

- rule: Deny Bash command writing sandbox-disable content to agent settings file
  desc: >
    Blocks Bash commands that reference an agent settings file path combined with
    sandbox-disabling content. Covers echo/tee/python3/node redirection. Hardened
    against Python capital-F False, null values, numeric 0 for enabled field, and
    numeric 1 for allowUnsandboxedCommands.
  condition: >
    tool.name = "Bash"
    and is_bash_sandbox_settings_path
    and is_bash_sandbox_disable_cmd
  output: >
    Falco blocked %agent.name from disabling its sandbox via Bash command: %tool.input_command
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, AML.T0054_llm_jailbreak, AML.T0051_llm_prompt_injection,
         mitre_t1562.001_impair_defenses_disable_or_modify_tools]

- rule: Deny Codex CLI sandbox bypass flag
  desc: >
    Blocks Bash invocations of the Codex CLI with flags that bypass sandbox
    isolation. Covers both dash and underscore variants of
    dangerously-bypass-approvals-and-sandbox, and --sandbox danger-full-access.
  condition: >
    tool.name = "Bash"
    and is_codex_sandbox_bypass
  output: >
    Falco blocked %agent.name from starting Codex with a sandbox bypass flag (%tool.input_command)
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, AML.T0054_llm_jailbreak, AML.T0051_llm_prompt_injection,
         mitre_t1562.001_impair_defenses_disable_or_modify_tools]

- rule: Deny Gemini CLI sandbox disable via environment variable
  desc: >
    Blocks Bash commands that set GEMINI_SANDBOX to a disabling value (none,
    false, disabled, 0). Covers inline assignment, exported assignment, and
    numeric zero.
  condition: >
    tool.name = "Bash"
    and is_gemini_sandbox_env_bypass
  output: >
    Falco blocked %agent.name from disabling Gemini sandbox via environment variable (%tool.input_command)
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, AML.T0054_llm_jailbreak, AML.T0051_llm_prompt_injection,
         mitre_t1562.001_impair_defenses_disable_or_modify_tools]

- rule: Deny Bash command replacing agent sandbox settings file
  desc: >
    Blocks Bash commands that replace an agent sandbox settings file via cp, mv,
    or sed -i. These operations bypass Rule C because the sandbox-disabling payload
    is in the source file — no disable keywords appear in the cp/mv/sed command.
    A cp from /tmp signals a staged payload (also caught by the tmp-staging rule
    in Section 4); sed -i indicates a content-oblivious rewrite.
  condition: >
    tool.name = "Bash"
    and is_bash_sandbox_settings_replace
  output: >
    Falco blocked %agent.name from replacing an agent sandbox settings file (%tool.input_command)
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, AML.T0054_llm_jailbreak, AML.T0051_llm_prompt_injection,
         mitre_t1562.001_impair_defenses_disable_or_modify_tools]

# ===========================================================================
# Section 4 — Threats: credentials, dangerous commands, exfiltration, supply chain
# ===========================================================================
# Covers credential access (via Bash and via Read tool), dangerous shell
# commands, pipe-to-shell, encoded payloads, data exfiltration, IMDS access,
# credential archives, SSH covert tunnels, cron persistence, history wipe,
# package publish, shell startup file edits, agent instruction files outside
# the working directory, cross-agent auth file reads, untrusted-host installs,
# MCP execution from temp directories, and credential glob patterns.

# Macros — Bash threat detection

- macro: is_bash
  condition: tool.name = "Bash"

- macro: references_credential
  condition: >
    tool.input_command contains ".aws/credentials"
    or tool.input_command contains ".aws/config"
    or tool.input_command contains "/.ssh/id_rsa"
    or tool.input_command contains "/.ssh/id_ed25519"
    or tool.input_command contains "/.ssh/id_ecdsa"
    or tool.input_command contains "/.gnupg/"
    or tool.input_command contains "/.netrc"
    or tool.input_command contains "/.npmrc"
    or tool.input_command contains "/.docker/config.json"
    or tool.input_command contains "/.kube/"
    or tool.input_command contains "/.azure/"
    or tool.input_command contains "/.config/gcloud/"
    or tool.input_command contains "/.git-credentials"
    or tool.input_command contains "credentials.json"
    or tool.input_command contains "AWS_SECRET_ACCESS_KEY"
    or tool.input_command contains "GITHUB_TOKEN"
    or tool.input_command contains "ANTHROPIC_API_KEY"
    or tool.input_command contains "OPENAI_API_KEY"

- macro: is_pipe_to_shell
  condition: >
    tool.input_command contains "| bash"
    or tool.input_command contains "|bash"
    or tool.input_command contains "| sh"
    or tool.input_command contains "|sh"
    or tool.input_command contains "| zsh"
    or tool.input_command contains "|zsh"
    or tool.input_command contains "bash <("
    or tool.input_command contains "sh <("
    or tool.input_command contains "| /bin/bash"
    or tool.input_command contains "|/bin/bash"
    or tool.input_command contains "| /bin/sh"
    or tool.input_command contains "|/bin/sh"
    or tool.input_command contains "| /usr/bin/bash"
    or tool.input_command contains "|/usr/bin/bash"
    or tool.input_command contains "| /usr/bin/sh"
    or tool.input_command contains "|/usr/bin/sh"

- macro: is_encoded_exec
  condition: >
    tool.input_command contains "base64 -d"
    or tool.input_command contains "base64 --decode"
    or tool.input_command contains "base64 -D"
    or tool.input_command contains "openssl base64 -d"
    or tool.input_command contains "xxd -r"
    or tool.input_command contains "python3 -c"
    or tool.input_command contains "python -c"
    or tool.input_command contains "perl -e"
    or tool.input_command contains "ruby -e"
    or tool.input_command contains "node -e"
    or tool.input_command contains "node --eval"
    or tool.input_command contains "php -r"

- macro: is_curl_exfil
  condition: >
    (tool.input_command contains "curl " or tool.input_command contains "wget ")
    and (tool.input_command contains " -d "
         or tool.input_command contains " --data"
         or tool.input_command contains " -F "
         or tool.input_command contains " --form"
         or tool.input_command contains " -T "
         or tool.input_command contains " --upload-file"
         or tool.input_command contains "@/tmp/"
         or tool.input_command contains "@/var/"
         or tool.input_command contains "| curl"
         or tool.input_command contains "| wget")

# Destructive commands with high-confidence intent. Substrings here are
# specific enough to deny outright (dd if=, mkfs, > /dev/sda, init 0,
# sudo su, sudo -i — none of which appear naturally in coding workflows).
- macro: is_destructive_command
  condition: >
    tool.input_command contains "dd if="
    or tool.input_command contains "dd of="
    or tool.input_command contains "mkfs"
    or tool.input_command contains "> /dev/sda"
    or tool.input_command contains "init 0"
    or tool.input_command contains "sudo su"
    or tool.input_command contains "sudo -i"

# Likely-destructive commands whose substrings collide with legitimate
# development workflows: rm -rf is common in cleanup scripts and build
# tooling; "shutdown"/"reboot"/"halt" appear in prose, comments, and
# unrelated tool names. Ask rather than deny.
# Likely-destructive commands. shutdown/reboot/halt require care:
#   - bare 'shutdown' is mostly echo prose — match only with real flags
#     or via the systemd / sudo / absolute-path wrappers.
#   - 'reboot' and 'halt' are valid bare commands — match them in
#     command-position contexts (start of line, after `;`/`&&`) and via
#     the same wrappers.
- macro: is_likely_destructive_command
  condition: >
    tool.input_command contains "rm -rf"
    or tool.input_command contains "rm -fr"
    or tool.input_command contains "rm --recursive"
    or tool.input_command contains "sudo rm "
    or tool.input_command startswith "shutdown -"
    or tool.input_command startswith "shutdown now"
    or tool.input_command startswith "shutdown +"
    or tool.input_command contains "; shutdown -"
    or tool.input_command contains "; shutdown now"
    or tool.input_command contains "&& shutdown -"
    or tool.input_command contains "&& shutdown now"
    or tool.input_command contains "| shutdown -"
    or tool.input_command contains "/sbin/shutdown"
    or tool.input_command contains "sudo shutdown"
    or tool.input_command contains "systemctl poweroff"
    or tool.input_command startswith "reboot"
    or tool.input_command contains "; reboot"
    or tool.input_command contains "&& reboot"
    or tool.input_command contains "/sbin/reboot"
    or tool.input_command contains "sudo reboot"
    or tool.input_command contains "systemctl reboot"
    or tool.input_command startswith "halt"
    or tool.input_command contains "; halt"
    or tool.input_command contains "&& halt"
    or tool.input_command contains "/sbin/halt"
    or tool.input_command contains "sudo halt"
    or tool.input_command contains "systemctl halt"

# Pure search/print commands whose substrings often collide with destructive
# patterns (e.g. `rg 'rm -rf' file`, `echo "shutdown"`). To stay safe under
# command chaining, the exemption requires the head command to be one of the
# listed read-only utilities AND the input to contain no `&&`, `||`, `;`,
# `$(`, or backticks. Pipes are allowed (the destructive substring still
# matches when piped — `xargs rm -rf` is a known gap, accepted because the
# common `rg | head` flow is the dominant case).
- macro: is_pure_search_or_print_command
  condition: >
    (tool.input_command startswith "rg "
     or tool.input_command startswith "grep "
     or tool.input_command startswith "ag "
     or tool.input_command startswith "find "
     or tool.input_command startswith "git grep "
     or tool.input_command startswith "git log "
     or tool.input_command startswith "git show "
     or tool.input_command startswith "git diff"
     or tool.input_command startswith "echo "
     or tool.input_command startswith "printf "
     or tool.input_command startswith "cat ")
    and not tool.input_command contains "&&"
    and not tool.input_command contains "||"
    and not tool.input_command contains ";"
    and not tool.input_command contains "$("
    and not tool.input_command contains "`"

- macro: is_tmp_path
  condition: >
    tool.real_file_path startswith "/tmp/"
    or tool.real_file_path startswith "/var/tmp/"
    or tool.real_file_path startswith "/dev/shm/"

# Matches Read tool calls targeting credential file paths.
# Uses real_file_path (canonicalized) so symlinked paths are also covered.
# The Bash credential rule covers tool.input_command; this covers tool.real_file_path
# for direct Read calls — closing the gap where the agent bypasses Bash entirely
# by using the Read tool to exfiltrate secrets.
- macro: is_read_credential_path
  condition: >
    tool.name = "Read"
    and tool.real_file_path != ""
    and (tool.real_file_path contains "/.aws/credentials"
         or tool.real_file_path contains "/.aws/config"
         or tool.real_file_path contains "/.ssh/id_rsa"
         or tool.real_file_path contains "/.ssh/id_ed25519"
         or tool.real_file_path contains "/.ssh/id_ecdsa"
         or tool.real_file_path contains "/.gnupg/"
         or tool.real_file_path contains "/.netrc"
         or tool.real_file_path contains "/.docker/config.json")

# Shell-based reverse shell techniques.
# is_reverse_shell_mkfifo_nc is a helper macro to avoid an (A and B) term
# inside an or-chain, which can cause Falco condition parser issues.
- macro: is_reverse_shell_mkfifo_nc
  condition: >
    tool.input_command contains "mkfifo"
    and tool.input_command contains " nc "

- macro: is_reverse_shell
  condition: >
    tool.input_command contains "/dev/tcp/"
    or tool.input_command contains ">&/dev/tcp"
    or tool.input_command contains ">& /dev/tcp"
    or tool.input_command contains "bash -i"
    or tool.input_command contains "nc -e"
    or tool.input_command contains "nc -c"
    or tool.input_command contains "ncat --exec"
    or tool.input_command contains "ncat -e"
    or tool.input_command contains "socat exec:"
    or is_reverse_shell_mkfifo_nc
    or tool.input_command contains "exec 5<>"

# curl/wget targeting cloud instance metadata endpoints.
# Covers the GET case not caught by is_curl_exfil (which requires POST/upload flags).
# AWS IMDS 169.254.169.254 can be encoded as:
#   Decimal: 2852039166   (169*16777216 + 254*65536 + 169*256 + 254)
#   Hex:     0xa9fea9fe
#   Octal:   0251.0376.0251.0376
# These numeric forms resolve identically in curl/wget but bypass the literal check.
- macro: is_imds_access
  condition: >
    (tool.input_command contains "curl " or tool.input_command contains "wget ")
    and (tool.input_command contains "169.254.169.254"
         or tool.input_command contains "metadata.google.internal"
         or tool.input_command contains "metadata.azure.com"
         or tool.input_command contains "fd00:ec2::254"
         or tool.input_command contains "2852039166"
         or tool.input_command contains "0xa9fea9fe"
         or tool.input_command contains "0Xa9fea9fe"
         or tool.input_command contains "0251.0376.0251.0376")

# Archive commands that include credential directories in their paths.
- macro: is_credential_archive
  condition: >
    (tool.input_command contains "tar " or tool.input_command contains "zip "
     or tool.input_command contains "gzip " or tool.input_command contains "7z "
     or tool.input_command contains "rar ")
    and (tool.input_command contains "/.aws"
         or tool.input_command contains "/.ssh"
         or tool.input_command contains "/.gnupg"
         or tool.input_command contains "/.kube"
         or tool.input_command contains "/.docker")

# SSH port forwarding flags used to create covert channels.
# -R (remote forward) and -D (SOCKS proxy) are flagged; -L (local forward,
# common for DB tunneling) is intentionally excluded.
- macro: is_ssh_tunnel
  condition: >
    tool.input_command contains "ssh "
    and (tool.input_command contains " -R "
         or tool.input_command contains " -D "
         or tool.input_command contains " -w ")

# Commands that install or modify cron jobs.
# Uses "crontab -" to avoid matching filenames containing "crontab" (e.g. grep crontab file).
- macro: is_cron_persistence
  condition: >
    tool.input_command contains "crontab -"
    or tool.input_command contains "| crontab"
    or tool.input_command contains "/etc/cron"

# Commands that wipe or suppress shell history.
# Uses specific file names (.bash_history, .zsh_history) to avoid matching
# "rm some-history-file.txt" or "grep history /etc/hosts".
# Helper macros avoid (A and B) terms inside or-chains.
- macro: is_history_wipe_rm_bash
  condition: >
    tool.input_command contains "rm "
    and tool.input_command contains ".bash_history"

- macro: is_history_wipe_rm_zsh
  condition: >
    tool.input_command contains "rm "
    and tool.input_command contains ".zsh_history"

- macro: is_history_wipe_truncate
  condition: >
    tool.input_command contains "truncate "
    and tool.input_command contains "_history"

- macro: is_history_wipe
  condition: >
    tool.input_command contains "history -c"
    or tool.input_command contains "history -w"
    or tool.input_command contains "unset HISTFILE"
    or tool.input_command contains "HISTSIZE=0"
    or tool.input_command contains "HISTFILESIZE=0"
    or is_history_wipe_rm_bash
    or is_history_wipe_rm_zsh
    or is_history_wipe_truncate

# Package registry publish commands across major ecosystems.
- macro: is_package_publish
  condition: >
    tool.input_command contains "npm publish"
    or tool.input_command contains "twine upload"
    or tool.input_command contains "cargo publish"
    or tool.input_command contains "gem push"
    or tool.input_command contains "pip upload"

# Reading another agent's OAuth or session credential files.
# Each agent should only read its own credential store. The negation
# (agent.name != X) excludes the owning agent from the deny.
# Helper macros avoid (A and B) terms inside or-chains in is_cross_agent_auth_read.
- macro: is_gemini_auth_cross
  condition: >
    tool.real_file_path contains "/.gemini/oauth_creds"
    and agent.name != "gemini"

- macro: is_codex_auth_cross
  condition: >
    tool.real_file_path contains "/.codex/auth"
    and agent.name != "codex"

- macro: is_cursor_auth_cross
  condition: >
    tool.real_file_path contains "/.cursor/session"
    and agent.name != "cursor"

- macro: is_claude_auth_cross
  condition: >
    tool.real_file_path contains "/.claude/oauth"
    and agent.name != "claude_code"

- macro: is_cross_agent_auth_read
  condition: >
    tool.name = "Read"
    and (is_gemini_auth_cross
         or is_codex_auth_cross
         or is_cursor_auth_cross
         or is_claude_auth_cross)

# Package/skill install commands referencing known malicious code hosts.
# Dual-signal: install command + untrusted host. Legitimate installs from
# npmjs.com, pypi.org, or official GitHub are not affected.
- macro: is_mcp_install_from_untrusted
  condition: >
    (tool.input_command contains "npx "
     or tool.input_command contains "npm install"
     or tool.input_command contains "uvx "
     or tool.input_command contains "pip install"
     or tool.input_command contains "claude skills install"
     or tool.input_command contains "claude plugin install")
    and cmd_contains_ioc_domain

# MCP server transport flags (--stdio, --sse) combined with a temp path.
# No legitimate MCP server is installed to /tmp or /dev/shm.
- macro: is_mcp_temp_path
  condition: >
    (tool.input_command contains "/tmp/"
     or tool.input_command contains "/dev/shm/"
     or tool.input_command contains "/var/tmp/")
    and (tool.input_command contains "--stdio"
         or tool.input_command contains "--sse")

# Glob patterns that target credential directories or key files.
# Matches absolute-path patterns (/.aws/, /.ssh/, etc.) in tool.input JSON.
# Relative patterns like **/.env inside a project are not affected.
- macro: is_credential_glob
  condition: >
    tool.name = "Glob"
    and (tool.input contains "/.aws/"
         or tool.input contains "/.ssh/"
         or tool.input contains "/.gnupg/"
         or tool.input contains "/.kube/"
         or tool.input contains "/id_rsa"
         or tool.input contains "/id_ed25519"
         or tool.input contains "oauth_creds")

# Container privilege-escalation and host-breakout patterns in container-run
# commands. The flags below are shared by docker, podman, and nerdctl, so the
# substring matches are runtime-agnostic and cover run/create/exec alike.
# Each is a documented route to host-equivalent power or container escape —
# for a coding agent, a clean way out of whatever containment Prempti is meant
# to complement, and one Prempti cannot observe after the fact (it only sees
# what the agent declares at the hook layer). Ask rather than deny: dind,
# devcontainers, and GPU/CI workloads use several of these flags legitimately.
# Helpers are split into separate macros to keep the umbrella readable and to
# avoid (A and B) terms nested inside an or-chain.

# --privileged on run/create/exec — full host device + capability access.
- macro: is_container_privileged_flag
  condition: tool.input_command contains "--privileged"

# Added Linux capabilities (--cap-add=SYS_ADMIN, =ALL, =SYS_PTRACE, …).
- macro: is_container_cap_add
  condition: tool.input_command contains "--cap-add"

# Disabled seccomp/AppArmor/SELinux profiles or unconfined system paths.
# Deliberately matches the dangerous values, not bare --security-opt, so the
# hardening value --security-opt no-new-privileges does not trigger an ask.
- macro: is_container_security_opt_unconfined
  condition: >
    tool.input_command contains "seccomp=unconfined"
    or tool.input_command contains "apparmor=unconfined"
    or tool.input_command contains "systempaths=unconfined"
    or tool.input_command contains "label=disable"
    or tool.input_command contains "label:disable"

# Shared host namespaces, both = and space separated. --pid=host enables
# nsenter into host PID 1; --ipc/--userns/--uts/--cgroupns=host weaken
# isolation; --net/--network=host exposes host-bound services (the most
# common of these in benign dev — relax via override first if it nags).
- macro: is_container_host_namespace
  condition: >
    tool.input_command contains "--pid=host"
    or tool.input_command contains "--pid host"
    or tool.input_command contains "--ipc=host"
    or tool.input_command contains "--ipc host"
    or tool.input_command contains "--userns=host"
    or tool.input_command contains "--userns host"
    or tool.input_command contains "--uts=host"
    or tool.input_command contains "--uts host"
    or tool.input_command contains "--cgroupns=host"
    or tool.input_command contains "--cgroupns host"
    or tool.input_command contains "--network=host"
    or tool.input_command contains "--network host"
    or tool.input_command contains "--net=host"
    or tool.input_command contains "--net host"

# Docker daemon socket exposed to or targeted by the command — a container
# with the socket mounted can spawn a privileged sibling and own the host;
# DOCKER_HOST= points the client at an arbitrary daemon.
- macro: is_container_docker_socket
  condition: >
    tool.input_command contains "docker.sock"
    or tool.input_command contains "DOCKER_HOST="

# Host root filesystem bind-mounted into the container (-v /:… or
# --mount source=/,…) — direct read/write of the entire host.
- macro: is_container_host_root_mount
  condition: >
    tool.input_command contains "-v /:"
    or tool.input_command contains "--volume /:"
    or tool.input_command contains "source=/,"
    or tool.input_command contains "src=/,"

# Raw host device passthrough (--device=/dev/…). Covers /dev/mem, raw disks,
# etc.; also matches benign GPU/USB passthrough, hence ask not deny.
- macro: is_container_device_passthrough
  condition: >
    tool.input_command contains "--device=/dev/"
    or tool.input_command contains "--device /dev/"

# nsenter into the host's namespaces via init (PID 1) — the standard breakout
# once --pid=host or the docker socket is available. Gated on targeting PID 1
# so the word nsenter alone in prose does not match.
- macro: is_nsenter_host
  condition: >
    tool.input_command contains "nsenter"
    and (tool.input_command contains "-t 1"
         or tool.input_command contains "--target 1"
         or tool.input_command contains "-t1")

- macro: is_container_privilege_escalation
  condition: >
    is_container_privileged_flag
    or is_container_cap_add
    or is_container_security_opt_unconfined
    or is_container_host_namespace
    or is_container_docker_socket
    or is_container_host_root_mount
    or is_container_device_passthrough
    or is_nsenter_host

# Rules

- rule: Deny credential file access via Bash
  desc: >
    Blocks Bash commands that reference credential files or secret environment
    variable names. Prevents exfiltration of secrets through shell redirection
    that the Read tool rules cannot intercept (e.g., cat ~/.aws/credentials,
    inline AWS_SECRET_ACCESS_KEY= substitutions).
  condition: is_bash and references_credential
  output: >
    Falco blocked a Bash command referencing a credential path or secret token (%tool.input_command)
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, mitre_t1552_unsecured_credentials]

- rule: Deny credential file access via Read tool
  desc: >
    Blocks Read tool calls targeting well-known credential file paths:
    ~/.aws/credentials, ~/.aws/config, ~/.ssh/id_* private keys, ~/.gnupg/,
    ~/.netrc, and ~/.docker/config.json. The Bash credential rule only inspects
    tool.input_command and misses direct Read calls entirely — an agent can
    Read ~/.aws/credentials without executing a shell command. Credential file
    reads have no legitimate use in a coding workflow; any access warrants an
    immediate block.
  condition: is_read_credential_path
  output: >
    Falco blocked the Read tool accessing a credential file at %tool.real_file_path
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, mitre_t1552_unsecured_credentials]

- rule: Deny destructive system commands
  desc: >
    Blocks shell commands whose substrings unambiguously indicate a destructive
    or privilege-elevating operation: dd overwriting a disk (dd if=, dd of=),
    filesystem creation (mkfs), direct device redirects (> /dev/sda), system
    halt (init 0), and unconstrained privilege escalation (sudo su, sudo -i).
    None of these appear in normal coding-agent workflows.
  condition: is_bash and is_destructive_command
  output: >
    Falco blocked a destructive system command (%tool.input_command)
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, mitre_t1485_data_destruction]

- rule: Ask before potentially destructive shell commands
  desc: >
    Requires user confirmation before commands whose dangerous form overlaps
    with legitimate development workflows or whose substrings collide with
    benign content: rm -rf / rm -fr / rm --recursive (common in build cleanup
    and Makefiles), sudo rm (admin tasks), and shutdown / reboot / halt
    (which also appear in prose and unrelated tool names like "graceful
    shutdown" comments). Asks rather than denies because the substring match
    cannot distinguish a build cleanup from a destructive operation.
  condition: is_bash and is_likely_destructive_command and not is_pure_search_or_print_command
  output: >
    Falco requires confirmation before a potentially destructive shell command (%tool.input_command)
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, mitre_t1485_data_destruction]

- rule: Ask before container privilege escalation or host breakout
  desc: >
    Requires user confirmation before Bash commands that grant a container
    host-equivalent power or break out of container isolation: --privileged,
    --cap-add, disabled seccomp/AppArmor/SELinux profiles (--security-opt
    *=unconfined or label=disable), shared host namespaces (--pid / --ipc /
    --userns / --uts / --cgroupns / --network = host), Docker daemon socket
    exposure (docker.sock, DOCKER_HOST=), host root bind mounts (-v /: or
    --mount source=/), raw device passthrough (--device=/dev/), and nsenter
    into host PID 1. The flags are shared by docker, podman, and nerdctl.
    Prempti runs in user space and only sees what the agent declares at the
    hook layer, so a privileged container is a route to host access it cannot
    observe afterward. Asks rather than denies because dind, devcontainers,
    and GPU/CI workloads use these flags legitimately; --network=host is the
    most common of these in benign dev and is the first to relax via override.
  condition: is_bash and is_container_privilege_escalation
  output: >
    Falco requires confirmation before %agent.name runs a container command that escalates privileges or breaks out of container isolation (%tool.input_command)
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, mitre_t1611_escape_to_host, mitre_t1610_deploy_container]

- rule: Deny pipe to shell interpreter
  desc: >
    Blocks Bash commands that pipe network-fetched or generated content directly
    into a shell interpreter. Covers curl|bash, wget|sh, bash <(...), and
    similar patterns used for remote code execution and supply chain attacks.
  condition: is_bash and is_pipe_to_shell
  output: >
    Falco blocked piping content to a shell interpreter (%tool.input_command)
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, mitre_t1059_command_and_scripting_interpreter, mitre_t1105_ingress_tool_transfer]

- rule: Deny encoded payload execution
  desc: >
    Blocks execution of base64-decoded or hex-decoded payloads and inline
    interpreter one-liners (python -c, perl -e, ruby -e). Encoding and inline
    interpreters are common obfuscation techniques to evade string-match detection.
  condition: is_bash and is_encoded_exec
  output: >
    Falco blocked execution of a potentially encoded or inline-interpreted payload (%tool.input_command)
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, mitre_t1027_obfuscated_files_or_information, mitre_t1140_deobfuscate_decode_files_or_information]

- rule: Deny curl wget exfiltration
  desc: >
    Blocks outbound data transfers via curl or wget that POST, upload, or pipe
    data to an external host. Prevents the write-to-tmp-then-exfiltrate pattern.
    Plain GET downloads (curl https://...) are not affected.
  condition: is_bash and is_curl_exfil
  output: >
    Falco blocked a potential data exfiltration command via curl or wget (%tool.input_command)
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, AML.T0025_exfiltration_via_cyber_means, mitre_t1567_exfiltration_over_web_service]

- rule: Ask before writing to tmp staging paths
  desc: >
    Requires user confirmation for Write and Edit operations targeting
    /tmp, /var/tmp, and /dev/shm. These paths are commonly used as staging
    areas for data exfiltration (write sensitive data, then curl it out),
    but they are also legitimate scratch areas for many coding workflows
    (build artifacts, test fixtures, agent-built scripts). Asks rather than
    denies because the path alone is not a sufficient signal of malicious
    intent — the exfiltration follow-up is caught by the curl/wget rule.
  condition: >
    is_write_tool
    and tool.real_file_path != ""
    and is_tmp_path
  output: >
    Falco requires confirmation before writing to the staging path %tool.real_file_path
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, mitre_t1074_data_staged]

- rule: Deny reverse shell via Bash
  desc: >
    Blocks Bash commands that establish reverse shell connections: /dev/tcp
    redirection, nc/ncat with exec, socat exec, and mkfifo pipe shells.
    These patterns have no legitimate use in a coding workflow.
  condition: is_bash and is_reverse_shell
  output: >
    Falco blocked a reverse shell command (%tool.input_command)
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, mitre_t1059_command_and_scripting_interpreter]

- rule: Deny cloud metadata service access via Bash
  desc: >
    Blocks curl and wget requests to cloud instance metadata services
    (AWS IMDS 169.254.169.254, GCP metadata.google.internal, Azure metadata.azure.com).
    These endpoints expose IAM credentials. Plain GET requests are not covered
    by the existing curl/wget exfiltration rule (which requires POST/upload flags).
  condition: is_bash and is_imds_access
  output: >
    Falco blocked access to a cloud metadata service (%tool.input_command)
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, mitre_t1552.005_cloud_instance_metadata_api]

- rule: Deny credential directory archive via Bash
  desc: >
    Blocks shell commands that compress credential directories (/.aws, /.ssh,
    /.gnupg, /.kube, /.docker) with tar, zip, gzip, 7z, or rar. Archiving
    credential directories is the first step in a compress-then-exfiltrate pattern.
  condition: is_bash and is_credential_archive
  output: >
    Falco blocked archiving a credential directory (%tool.input_command)
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, mitre_t1560_archive_collected_data, mitre_t1552_unsecured_credentials]

- rule: Deny SSH reverse tunnel and SOCKS proxy
  desc: >
    Blocks SSH commands using reverse port forwarding (-R), SOCKS proxy (-D),
    or VPN tunnel (-w) flags. These create covert outbound channels. Legitimate
    direct SSH and local port forwarding (-L, common for database tunneling)
    are intentionally excluded.
  condition: is_bash and is_ssh_tunnel
  output: >
    Falco blocked an SSH tunneling or proxy command (%tool.input_command)
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, mitre_t1572_protocol_tunneling]

- rule: Ask before cron and scheduled task manipulation
  desc: >
    Requires confirmation before crontab modifications or writes targeting
    /etc/cron directories. Scheduled tasks are a persistence mechanism —
    unexpected from a coding session but not always malicious (e.g., app
    setup scripts), so ask rather than deny.
  condition: is_bash and is_cron_persistence
  output: >
    Falco requires confirmation before modifying cron configuration (%tool.input_command)
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, mitre_t1053_scheduled_task_job]

- rule: Deny audit trail destruction
  desc: >
    Blocks commands that wipe shell history: history -c/history -w, unset HISTFILE,
    HISTSIZE=0, and removal or truncation of .bash_history/.zsh_history.
    History wiping is a post-compromise covering technique with no legitimate
    use in a coding session.
  condition: is_bash and is_history_wipe
  output: >
    Falco blocked a shell history wipe attempt (%tool.input_command)
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, mitre_t1070_indicator_removal]

- rule: Deny package publish
  desc: >
    Blocks publishing commands across major ecosystems: npm publish, twine upload,
    cargo publish, gem push, pip upload. Publishing packages is irreversible and
    a direct supply chain attack vector. Should always require explicit manual
    confirmation, not agent automation.
  condition: is_bash and is_package_publish
  output: >
    Falco blocked a package publish command (%tool.input_command)
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, AML.T0010_ml_supply_chain_compromise, mitre_t1195_supply_chain_compromise]

- rule: Ask before modifying shell startup files
  desc: >
    Requires confirmation when writing or editing shell startup files (.bashrc,
    .zshrc, .profile, etc.). These files execute on every shell login and are a
    persistence mechanism. Writing to them may be legitimate in dotfiles projects
    but always warrants explicit user confirmation.
  condition: >
    is_write_tool
    and tool.real_file_path != ""
    and (tool.file_name in (shell_startup_files)
         or basename(tool.real_file_path) in (shell_startup_files))
  output: >
    Falco requires confirmation before modifying shell startup file %tool.real_file_path
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, mitre_t1546.004_unix_shell_configuration_modification]

- rule: Ask before writing agent instruction files outside working directory
  desc: >
    Requires confirmation when writing or editing agent instruction files
    (.cursorrules, .windsurfrules, .aiderrules, AGENTS.md) outside the current
    working directory. Writing agent instructions to another project is a prompt
    injection vector. Writes inside the current project are allowed.
  condition: >
    is_write_tool
    and tool.real_file_path != ""
    and (tool.file_name in (agent_instruction_files)
         or basename(tool.real_file_path) in (agent_instruction_files))
    and is_outside_cwd
  output: >
    Falco requires confirmation before writing agent instruction file %tool.real_file_path outside working directory %agent.real_cwd
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, AML.T0051_llm_prompt_injection]

- rule: Deny cross-agent authentication file access
  desc: >
    Blocks reads of another agent's OAuth or session credential files. Each
    agent should only access its own credential store. A Claude Code session
    reading ~/.gemini/oauth_creds.json (or vice versa) signals prompt injection,
    credential harvesting, or a compromised session pivoting between agents.
  condition: is_cross_agent_auth_read
  output: >
    Falco blocked %agent.name from reading another agent's authentication file %tool.real_file_path
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, mitre_t1552_unsecured_credentials]

- rule: Deny MCP server or skill install from untrusted host
  desc: >
    Blocks npm, npx, uvx, pip install, and claude skills/plugin install commands
    that reference known malicious code hosting sites in the ioc_hosting_domains
    list. These are the primary supply chain IOCs from the ClawHavoc campaign.
    Legitimate installs from npmjs.com, pypi.org, and official GitHub are unaffected.
  condition: is_bash and is_mcp_install_from_untrusted
  output: >
    Falco blocked installing a package or skill from an untrusted host (%tool.input_command)
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, AML.T0010_ml_supply_chain_compromise, AML.T0048_llm_plugin_compromise]

- rule: Deny MCP server execution from temporary directory
  desc: >
    Blocks execution of processes using MCP transport flags (--stdio, --sse)
    from /tmp, /dev/shm, or /var/tmp. Legitimate MCP servers are installed to
    system or user package directories, not temporary storage. Running from /tmp
    indicates a staged payload dropped and immediately executed.
  condition: is_bash and is_mcp_temp_path
  output: >
    Falco blocked executing a potential MCP server from a temporary directory (%tool.input_command)
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, AML.T0048_llm_plugin_compromise]

- rule: Ask before Glob with credential directory patterns
  desc: >
    Requires confirmation when the Glob tool is used with patterns that target
    credential directories or key files (/.aws/, /.ssh/, /.gnupg/, /.kube/,
    id_rsa, id_ed25519, oauth_creds). Such patterns suggest credential
    reconnaissance before an exfiltration attempt. In-project .env globbing
    is not affected.
  condition: is_credential_glob
  output: >
    Falco requires confirmation before globbing with a credential-targeting pattern (%tool.input)
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, mitre_t1552_unsecured_credentials]

# ===========================================================================
# Section 5 — MCP and skill content
# ===========================================================================
# Detects supply chain attacks and prompt injection attempts that add or
# register malicious external tools to the coding agent.
#
# MCP vs. Skill attack surface:
#   MCP servers     — external processes, config in .mcp.json (JSON)
#                     Attack: poison the config entry (command path, URL, encoding)
#   Skills/Commands — instruction files in .claude/commands/ (Markdown)
#                     Attack: inject malicious content into the instruction file itself
#                     (prompt injection, IOC domain reference, embedded pipe-to-shell)
#
# Coverage:
#   Rule 1 (DENY):  MCP config write with "command" pointing to a temporary directory
#   Rule 2 (DENY):  MCP config write with IOC domain in the server "url" field
#   Rule 3 (ASK):   MCP config write with base64-encoded "command"
#   Rule 4 (ASK):   Agent self-registering MCP server via Bash (claude mcp add, etc.)
#   Rule 5 (ASK):   Write to .claude/commands/ — persistent slash command backdoor
#   Rule 6 (ASK):   CLAUDE.md write outside working directory — prompt injection
#   Rule 7 (DENY):  Skill/command file written with IOC domain in content
#   Rule 8 (DENY):  Skill/command file written with pipe-to-shell in content
#   Rule 9 (ASK):   npx -y / bunx -y / yarn dlx / pnpm dlx auto-accept installation
#   Rule 10 (ASK): Bash tool writing to .claude/commands/
#   Rule 11 (ASK): Write to .claude/agents/ — subagent definition, prompt injection
#   Rule 12 (ASK): Write to .claude/skills/ — skill definition, supply chain
#   Rule 13 (ASK): Write to .claude/plugins/ — plugin install metadata, hook/MCP/skill bypass
#   Rule 14 (ASK): Write to .claude/backups/ — staged settings rollback

# Macros

# Matches Write or Edit tool calls targeting MCP server configuration files.
# .mcp.json is the project-level MCP config; managed-mcp.json is the managed variant.
- macro: is_mcp_config_write
  condition: >
    is_write_tool
    and tool.real_file_path != ""
    and (tool.file_name in (".mcp.json", "managed-mcp.json")
         or basename(tool.real_file_path) in (".mcp.json", "managed-mcp.json"))

# Matches MCP config content where any path points to a temporary directory.
# Since the rule already restricts to .mcp.json / managed-mcp.json files,
# checking for temp paths anywhere in the content is specific enough: no
# legitimate MCP server config has a /tmp path in any field.
# $TMPDIR / $TMP / $TEMP are env var forms that expand to temp paths at runtime
# but contain no literal /tmp/ — they are added to close the env-var bypass.
# /run/user/ is the per-user runtime directory (XDG_RUNTIME_DIR), world-writable
# by the owning user and used as a staging area equivalent to /tmp.
- macro: is_mcp_command_temp
  condition: >
    tool.input contains "/tmp/"
    or tool.input contains "/dev/shm/"
    or tool.input contains "/var/tmp/"
    or tool.input contains "$TMPDIR"
    or tool.input contains "$TMP"
    or tool.input contains "$TEMP"
    or tool.input contains "/run/user/"

# Matches MCP config content containing base64 encoding anywhere in the config.
# Obfuscated paths or commands in MCP configs have no legitimate use.
- macro: is_mcp_command_encoded
  condition: tool.input contains "base64"

# Matches Bash commands that self-register MCP servers or plugins via the
# Claude Code CLI. Covers all registration subcommands.
- macro: is_mcp_self_register
  condition: >
    tool.input_command contains "claude mcp add"
    or tool.input_command contains "claude mcp install"
    or tool.input_command contains "claude mcp add-json"
    or tool.input_command contains "claude mcp add-from-claude-desktop"
    or tool.input_command contains "claude plugin install"
    or tool.input_command contains "claude skill add"

# Matches the Claude slash command directory path.
- macro: is_skill_commands_path
  condition: tool.real_file_path contains "/.claude/commands/"

# Matches Write/Edit to .claude/commands/ where the file content references
# a known malicious hosting domain. A skill file that directs Claude to fetch
# from pastebin.com or transfer.sh will cause the agent to retrieve and
# execute attacker-controlled content on the next invocation.
- macro: is_skill_content_ioc
  condition: is_skill_commands_path and contains_ioc_domain

# Matches Write/Edit to .claude/commands/ where the file content contains a
# pipe-to-shell pattern. Skills embedding these patterns instruct Claude to
# execute remote content directly through a shell interpreter.
# Absolute paths (| /bin/bash, | /bin/sh, | /usr/bin/bash, | /usr/bin/sh) are
# functionally identical to the short form but bypass simple string matches.
# Helper macros avoid (A and B) terms inside an or-chain.
- macro: is_skill_pipe_bash
  condition: >
    is_skill_commands_path
    and (tool.input contains "| bash"
         or tool.input contains "|bash"
         or tool.input contains "| sh"
         or tool.input contains "|sh"
         or tool.input contains "bash <("
         or tool.input contains "sh <("
         or tool.input contains "| /bin/bash"
         or tool.input contains "|/bin/bash"
         or tool.input contains "| /bin/sh"
         or tool.input contains "|/bin/sh"
         or tool.input contains "| /usr/bin/bash"
         or tool.input contains "|/usr/bin/bash"
         or tool.input contains "| /usr/bin/sh"
         or tool.input contains "|/usr/bin/sh")

# Matches package runner invocations that bypass installation confirmation with
# -y / --yes, or are always non-interactive by design (yarn dlx, pnpm dlx).
# Covers npx (npm), bunx (Bun), yarn dlx (yarn v2), and pnpm dlx (pnpm) — all
# functionally equivalent for MCP/skill package installation.
# yarn dlx is always non-interactive and requires no -y flag.
# pnpm dlx requires -y for auto-accept similar to npx.
- macro: is_npx_auto_accept_mcp_skill
  condition: >
    (tool.input_command contains "npx -y "
     or tool.input_command contains "npx --yes "
     or tool.input_command contains "bunx -y "
     or tool.input_command contains "bunx --yes "
     or tool.input_command contains "yarn dlx "
     or tool.input_command contains "pnpm dlx ")
    and (tool.input_command contains "mcp"
         or tool.input_command contains "skill"
         or tool.input_command contains "plugin"
         or tool.input_command contains "modelcontextprotocol"
         or tool.input_command contains "@anthropic"
         or tool.input_command contains "@openai"
         or tool.input_command contains "@google")

# Matches Bash commands that reference the Claude commands directory in a way
# that could write new skill files via shell redirection (echo >, tee, cat >).
# Rule 5 catches Write/Edit tool calls to this path; an attacker using the Bash
# tool with shell redirection bypasses that check entirely.
- macro: is_bash_commands_write
  condition: >
    tool.name = "Bash"
    and tool.input_command contains "/.claude/commands/"

# Rules

- rule: Deny MCP config with command from temporary directory
  desc: >
    Blocks writing an MCP server configuration file (.mcp.json, managed-mcp.json)
    where the server "command" field points to a temporary directory (/tmp, /dev/shm,
    /var/tmp). Legitimate MCP servers are installed to system or user package directories
    — never to temporary storage. A "command" in /tmp indicates a staged payload being
    registered as a persistent MCP server: the agent drops the binary first (caught by
    the tmp-staging rule), then creates the config to wire it in. This rule closes the
    Write/Edit vector that the existing Bash-level MCP temp-path rule (Section 4) does
    not cover.
  condition: is_mcp_config_write and is_mcp_command_temp
  output: >
    Falco blocked writing an MCP server config with a command path in temporary storage at %tool.real_file_path
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, AML.T0048_llm_plugin_compromise,
         AML.T0051_llm_prompt_injection, mitre_t1059_command_and_scripting_interpreter]

- rule: Deny MCP config with IOC domain in server URL
  desc: >
    Blocks writing an MCP server configuration file that includes a known malicious
    code-hosting domain (ioc_hosting_domains list) in the server "url" field.
    SSE-transport MCP servers specify their endpoint as a URL; the existing
    untrusted-host rule in Section 4 only inspects Bash install commands, not
    Write/Edit tool content. Domains are the confirmed IOCs from the ClawHavoc
    campaign targeting Claude Code, Gemini CLI, and Codex agents with 341 malicious
    skills distributed via paste and file-hosting sites.
  condition: is_mcp_config_write and contains_ioc_domain
  output: >
    Falco blocked writing an MCP server config with a malicious hosting domain in the server URL at %tool.real_file_path
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, AML.T0048_llm_plugin_compromise,
         AML.T0010_ml_supply_chain_compromise, mitre_t1059_command_and_scripting_interpreter]

- rule: Ask before MCP config with encoded server command
  desc: >
    Requires user confirmation when writing an MCP server configuration file
    that contains the substring "base64", indicating a possibly obfuscated
    server command decoded and executed at runtime. Typical malicious pattern:
    "command": "bash", "args": ["-c", "base64 -d <<< PAYLOAD | sh"].
    Asks rather than denies because the literal substring "base64" also
    appears in benign contexts: server names referencing base64 encoding,
    descriptions mentioning the algorithm, or data URLs (data:...;base64,...)
    used for icons and small assets in legitimate MCP configs.
  condition: is_mcp_config_write and is_mcp_command_encoded
  output: >
    Falco requires confirmation before writing an MCP server config that references base64 at %tool.real_file_path
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, AML.T0048_llm_plugin_compromise,
         AML.T0057_llm_data_poisoning, mitre_t1027_obfuscated_files_or_information]

- rule: Ask before agent self-registering MCP server
  desc: >
    Requires user confirmation when the agent invokes claude mcp add, claude mcp add-json,
    claude mcp install, claude mcp add-from-claude-desktop, claude plugin install, or
    claude skill add through the Bash tool. An agent autonomously expanding its own tool
    surface by adding MCP servers or plugins is an excessive agency indicator and a
    supply chain pivot vector — the agent gains access to new external services without
    explicit human approval.
  condition: tool.name = "Bash" and is_mcp_self_register
  output: >
    Falco requires confirmation before the agent self-registers an MCP server or plugin (%tool.input_command)
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, AML.T0048_llm_plugin_compromise,
         AML.T0054_llm_jailbreak, mitre_t1059_command_and_scripting_interpreter]

- rule: Ask before writing to Claude slash command directory
  desc: >
    Requires user confirmation when the agent writes or edits files under .claude/commands/.
    This directory contains custom slash commands that execute arbitrary Bash on invocation
    (the file content is the shell command that runs when a user types /commandname).
    Writing here is a persistent backdoor vector: an injected prompt or malicious skill can
    create a new /slash command that runs attacker-controlled code in every subsequent Claude
    Code session. Unlike tool calls, slash command files persist indefinitely and are not
    visible to the user without explicitly inspecting the commands directory.
  condition: >
    is_write_tool
    and tool.real_file_path != ""
    and tool.real_file_path contains "/.claude/commands/"
  output: >
    Falco requires confirmation before writing a Claude slash command at %tool.real_file_path
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, AML.T0051_llm_prompt_injection,
         AML.T0043_craft_adversarial_data, mitre_t1546_event_triggered_execution]

- rule: Ask before writing CLAUDE.md outside working directory
  desc: >
    Requires user confirmation when the agent writes or edits a CLAUDE.md file outside
    the current working directory. CLAUDE.md files in any ancestor directory inject
    instructions into Claude Code for all projects under that path — writing one to ~/,
    ~/projects/, or / is a prompt injection attack that persists across sessions and
    affects all future Claude Code invocations in that directory tree. The agent
    instruction files rule in Section 4 covers .cursorrules, .windsurfrules, AGENTS.md;
    this rule adds CLAUDE.md, Claude Code's own instruction file. Writes to CLAUDE.md
    inside the working project directory are allowed.
  condition: >
    is_write_tool
    and tool.real_file_path != ""
    and (tool.file_name = "CLAUDE.md"
         or basename(tool.real_file_path) = "CLAUDE.md")
    and is_outside_cwd
  output: >
    Falco requires confirmation before writing CLAUDE.md at %tool.real_file_path outside working directory %agent.real_cwd
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, AML.T0051_llm_prompt_injection,
         AML.T0043_craft_adversarial_data, mitre_t1059_command_and_scripting_interpreter]

- rule: Deny skill command file with IOC domain in content
  desc: >
    Blocks writing a skill or slash command file (under .claude/commands/) whose
    content references a known malicious code-hosting domain. Claude reads skill
    files as prompt context and follows their instructions — a skill that directs
    Claude to "fetch from pastebin.com and execute" will do exactly that on the
    next invocation. This converts the catch-all ask rule (Rule 5) to a hard deny
    for file content that conclusively indicates a supply chain attack.
  condition: >
    is_write_tool
    and tool.real_file_path != ""
    and is_skill_content_ioc
  output: >
    Falco blocked writing a skill file with a malicious hosting domain in its content at %tool.real_file_path
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, AML.T0051_llm_prompt_injection,
         AML.T0010_ml_supply_chain_compromise, mitre_t1546_event_triggered_execution]

- rule: Deny skill command file with pipe-to-shell in content
  desc: >
    Blocks writing a skill or slash command file (under .claude/commands/) whose
    content contains a pipe-to-shell pattern (| bash, | sh, bash <(...), sh <(...)).
    Skills with embedded pipe-to-shell instructions are the skill-layer equivalent
    of the pipe-to-shell Bash rule in Section 4: the agent will invoke the pattern
    as a tool call when the skill is triggered. Legitimate skills describe workflows
    and reference tools — they do not embed direct shell pipeline execution.
  condition: >
    is_write_tool
    and tool.real_file_path != ""
    and is_skill_pipe_bash
  output: >
    Falco blocked writing a skill file with a pipe-to-shell pattern in its content at %tool.real_file_path
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, AML.T0051_llm_prompt_injection,
         AML.T0043_craft_adversarial_data, mitre_t1546_event_triggered_execution]

- rule: Ask before npx auto-accept MCP or skill installation
  desc: >
    Requires user confirmation when npx, bunx, yarn dlx, or pnpm dlx is invoked
    with the -y / --yes flag (or is always non-interactive, as with yarn dlx)
    combined with an MCP server, skill, or plugin package name. The auto-accept
    flag silently bypasses the "install this package?" confirmation prompt,
    removing the human review step before the package executes. The untrusted-host
    rule in Section 4 only blocks IOC domains; this rule fires regardless of source
    since silent installation of any agent-extending package warrants explicit approval.
  condition: tool.name = "Bash" and is_npx_auto_accept_mcp_skill
  output: >
    Falco requires confirmation before auto-accepting package installation for an MCP server or skill (%tool.input_command)
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, AML.T0048_llm_plugin_compromise,
         AML.T0010_ml_supply_chain_compromise, mitre_t1059_command_and_scripting_interpreter]

- rule: Ask before Bash command writing to Claude slash command directory
  desc: >
    Requires user confirmation when a Bash command references the .claude/commands/
    directory. Shell redirections (echo >, tee, cat >) can write new slash command
    files without using the Write or Edit tools, bypassing Rule 5. Slash command
    files persist across sessions and execute arbitrary shell on invocation — any
    Bash-level write to this directory warrants explicit approval. Read-only access
    (ls, cat, grep) is flagged as well since reconnoitering the commands directory
    is a precursor to targeted injection. Asks rather than denies because legitimate
    maintenance tasks (listing commands, reading existing ones) also match.
  condition: is_bash_commands_write
  output: >
    Falco requires confirmation before a Bash command accesses the Claude slash command directory (%tool.input_command)
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, AML.T0051_llm_prompt_injection,
         AML.T0043_craft_adversarial_data, mitre_t1546_event_triggered_execution]

- rule: Ask before writing to Claude Code subagent definitions directory
  desc: >
    Requires user confirmation when the agent writes or edits files under
    ~/.claude/agents/. This directory holds custom subagent definitions —
    markdown files with YAML frontmatter that Claude Code reads as system
    prompt context for spawned subagents. A new or modified definition is
    a persistent prompt-injection vector: every future invocation of that
    subagent runs with attacker-controlled instructions. Legitimate
    subagent setup is user-driven (via the Claude CLI or marketplace);
    the coding agent has no need to author other agents' instructions.
  condition: >
    is_write_tool
    and tool.real_file_path != ""
    and tool.real_file_path contains "/.claude/agents/"
  output: >
    Falco requires confirmation before writing a Claude Code subagent definition at %tool.real_file_path
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, AML.T0051_llm_prompt_injection,
         AML.T0043_craft_adversarial_data, mitre_t1546_event_triggered_execution]

- rule: Ask before writing to Claude Code skills directory
  desc: >
    Requires user confirmation when the agent writes or edits files under
    ~/.claude/skills/. Skills are markdown definitions that Claude Code
    pulls into context to extend its behavior — they describe workflows,
    tool sequences, and reference external resources. Writing or editing
    a skill is the skill-layer equivalent of editing a slash command and
    carries the same persistence risk. Legitimate skill installation
    flows through the Claude CLI or the marketplace; direct file
    authoring by the agent warrants explicit approval.
  condition: >
    is_write_tool
    and tool.real_file_path != ""
    and tool.real_file_path contains "/.claude/skills/"
  output: >
    Falco requires confirmation before writing a Claude Code skill at %tool.real_file_path
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, AML.T0051_llm_prompt_injection,
         AML.T0010_ml_supply_chain_compromise, mitre_t1546_event_triggered_execution]

- rule: Ask before writing to Claude Code plugins directory
  desc: >
    Requires user confirmation when the agent writes or edits files under
    ~/.claude/plugins/. The plugins tree holds installed-plugin metadata
    (installed_plugins.json), known marketplaces, the marketplace
    blocklist, and cached plugin payloads. Plugins can register MCP
    servers, hooks, skills, and slash commands — modifying this tree
    directly bypasses the official install flow's review steps.
    Legitimate installs are user-initiated via the Claude CLI;
    agent-driven Write/Edit here is a supply-chain attack surface.
  condition: >
    is_write_tool
    and tool.real_file_path != ""
    and tool.real_file_path contains "/.claude/plugins/"
  output: >
    Falco requires confirmation before writing to Claude Code plugin storage at %tool.real_file_path
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, AML.T0048_llm_plugin_compromise,
         AML.T0010_ml_supply_chain_compromise, mitre_t1195_supply_chain_compromise]

- rule: Ask before writing to Claude Code settings backups directory
  desc: >
    Requires user confirmation when the agent writes or edits files
    under ~/.claude/backups/. Claude Code keeps timestamped backups of
    settings (.claude.json.backup.<epoch>) here. An agent writing into
    this tree could stage a malicious settings file that the user later
    restores manually, sidestepping the direct settings.json deny rule.
    Reads are not flagged — the directory is otherwise routine.
  condition: >
    is_write_tool
    and tool.real_file_path != ""
    and tool.real_file_path contains "/.claude/backups/"
  output: >
    Falco requires confirmation before writing to Claude Code settings backups at %tool.real_file_path
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, prempti_self_protection, mitre_t1562.001_impair_defenses_disable_or_modify_tools]

# ===========================================================================
# Section 6 — Persistence vectors
# ===========================================================================
# Detects agent actions that establish persistence across sessions or redirect
# package/API supply chains — vectors beyond MCP servers and skill files.
#
# Coverage:
#   Rule 1 (ASK):   Claude settings.json write with "hooks" key
#                   — injects a PreToolUse/PostToolUse script that runs on every
#                     future tool call, outside the sandbox, with no user visibility.
#                     Agent has no legitimate reason to write its own hooks; ASK
#                     because the "hooks" substring also surfaces in unrelated
#                     edits to settings.json where an existing hooks block is
#                     captured in old_string/new_string.
#   Rule 2 (ASK):   Claude settings.json write with "mcpServers" key
#                   — alternative MCP registration path not covered by .mcp.json rules
#   Rule 3 (ASK):   Write to .git/hooks/ directory
#                   — git hook executes on every git operation for the lifetime
#                     of the repository clone
#   Rule 4 (ASK):   Write to .npmrc / .pypirc / pip.conf / .pnpmrc / .yarnrc.yml
#                   with registry redirect
#   Rule 5 (ASK):   Write to .env / .envrc / .env.* with AI API base URL override
#   Rule 6 (ASK):   Write to .env / .envrc / .env.* with AI API key assignment
#   Rule 7 (ASK):   Bash command writing to .git/hooks/
#   Rule 8 (ASK):   Bash command running npm/pip config set for registry

# Macros: Claude settings file paths

# Matches Write or Edit targeting Claude Code's settings files.
# endswith covers both user-level (~/.claude/settings.json) and
# project-level (.claude/settings.json) with the same pattern.
- macro: is_claude_settings_write
  condition: >
    is_write_tool
    and tool.real_file_path != ""
    and (tool.real_file_path endswith "/.claude/settings.json"
         or tool.real_file_path endswith "/.claude/settings.local.json")

# Matches content that registers a hooks block (any lifecycle event).
# The "hooks" key is Claude Code's mechanism for running external commands
# before or after tool calls — the exact mechanism Prempti uses.
- macro: is_settings_hooks_content
  condition: tool.input contains "hooks"

# Matches content that registers MCP servers inside settings.json.
# Settings-level mcpServers are an alternative to standalone .mcp.json files
# and not covered by the Section 5 path-based checks.
- macro: is_settings_mcp_content
  condition: tool.input contains "mcpServers"

# Macros: git hooks

# Matches Write or Edit to files inside any .git/hooks/ directory.
# Uses real_file_path (canonicalized) so symlinked repos are also covered.
- macro: is_git_hooks_write
  condition: >
    is_write_tool
    and tool.real_file_path != ""
    and tool.real_file_path contains "/.git/hooks/"

# Matches Bash commands referencing the git hooks directory path.
# Rule 3 catches Write/Edit tool calls; shell redirection via Bash bypasses it.
- macro: is_bash_git_hooks_write
  condition: >
    tool.name = "Bash"
    and tool.input_command contains "/.git/hooks/"

# Macros: package registry redirect

# Matches Write or Edit to package manager configuration files that control
# where packages are downloaded from (registry_config_files list).
- macro: is_registry_config_write
  condition: >
    is_write_tool
    and tool.real_file_path != ""
    and (tool.file_name in (registry_config_files)
         or basename(tool.real_file_path) in (registry_config_files))

# Matches content keys that redirect package downloads to a custom index.
# registry=            — npm/pnpm registry (no space, npmrc/.pnpmrc format)
# npmRegistryServer    — yarn v2/v3 primary registry (in .yarnrc.yml)
# index-url            — pip primary index (pip.conf uses "key = value" with spaces)
# extra-index-url      — pip secondary index
# index-server         — pypirc server section header value
# Note: pip.conf and .pypirc use "key = value" format (spaces around =),
# so checks for the key name only — not "key=" — to match both styles.
# "repository" is intentionally excluded: .pypirc uses it as a section key,
# but the substring also matches benign comments and metadata keys (e.g.,
# "# our internal repository" in .npmrc) producing false positives.
- macro: is_registry_redirect_content
  condition: >
    tool.input contains "registry="
    or tool.input contains "npmRegistryServer"
    or tool.input contains "index-url"
    or tool.input contains "extra-index-url"
    or tool.input contains "index-server"

# Matches Bash commands running npm config set or pip config set to redirect
# the package registry. These modify the global ~/.npmrc or pip config file
# via the CLI, never going through the Write/Edit tool path.
- macro: is_bash_npm_registry_redirect
  condition: >
    (tool.input_command contains "npm config set registry"
     or tool.input_command contains "npm set registry")

- macro: is_bash_pip_registry_redirect
  condition: >
    (tool.input_command contains "pip config set"
     or tool.input_command contains "pip3 config set")
    and (tool.input_command contains "index-url"
         or tool.input_command contains "extra-index-url")

- macro: is_bash_registry_redirect
  condition: >
    is_bash_npm_registry_redirect
    or is_bash_pip_registry_redirect

# Macros: environment file API redirect and key exposure

# Matches Write or Edit to environment variable files that shells or tools
# source automatically (env_file_names list). Covers project-local variants
# to avoid false positives on remote/CI environment files not loaded locally.
- macro: is_env_file_write
  condition: >
    is_write_tool
    and tool.real_file_path != ""
    and (tool.file_name in (env_file_names)
         or basename(tool.real_file_path) in (env_file_names))

# Matches env content that overrides the AI API base URL.
# ANTHROPIC_BASE_URL — Claude Code / Anthropic SDK endpoint
# OPENAI_BASE_URL    — OpenAI SDK endpoint (used by some Codex forks)
# OPENAI_API_BASE    — legacy OpenAI env var for the same purpose
# Overriding these redirects ALL API calls through an attacker-controlled proxy.
- macro: is_api_base_url_override
  condition: >
    tool.input contains "ANTHROPIC_BASE_URL"
    or tool.input contains "OPENAI_BASE_URL"
    or tool.input contains "OPENAI_API_BASE"

# Matches env content that writes an AI provider API key.
# The agent writing its own API credentials to a file risks committing the
# key to version control or staging it for exfiltration in a later Bash step.
# Separate from is_api_base_url_override to allow different verdicts.
- macro: is_api_key_in_env
  condition: >
    tool.input contains "ANTHROPIC_API_KEY"
    or tool.input contains "OPENAI_API_KEY"
    or tool.input contains "GEMINI_API_KEY"

# Rules

- rule: Ask before agent writing hooks into Claude Code settings
  desc: >
    Requires user confirmation when the agent writes or edits a Claude Code
    settings file (~/.claude/settings.json or .claude/settings.json) with
    content matching the "hooks" keyword. Claude Code's hooks mechanism runs
    arbitrary external commands before or after every tool call — it is the
    same mechanism Prempti uses to intercept tool calls. The agent
    has no legitimate reason to modify its own hook configuration — hook
    registration is an installer/admin task, not an agent task. Asks rather
    than denies because the "hooks" substring also surfaces in unrelated
    edits to settings.json (an existing hooks block captured in
    old_string/new_string when editing a sibling key, the word "hooks" in
    benign content like "react-hooks" or comments).
  condition: is_claude_settings_write and is_settings_hooks_content
  output: >
    Falco requires confirmation before %agent.name writes a hooks entry into Claude Code settings at %tool.real_file_path
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, AML.T0051_llm_prompt_injection,
         AML.T0043_craft_adversarial_data, mitre_t1546_event_triggered_execution]

- rule: Ask before agent registering MCP servers in Claude settings
  desc: >
    Requires user confirmation when the agent writes or edits a Claude Code
    settings file with an mcpServers key. MCP servers registered in settings.json
    persist across all projects (user-level) or all sessions in a project
    (project-level) and grant the agent access to new external tool surfaces.
    Section 5 covers the standalone .mcp.json and managed-mcp.json files; this
    rule closes the settings.json registration path that bypasses those checks.
  condition: is_claude_settings_write and is_settings_mcp_content
  output: >
    Falco requires confirmation before %agent.name registers an MCP server in Claude Code settings at %tool.real_file_path
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, AML.T0048_llm_plugin_compromise,
         AML.T0051_llm_prompt_injection, mitre_t1059_command_and_scripting_interpreter]

- rule: Ask before writing to git hooks directory
  desc: >
    Requires user confirmation when the agent writes or edits a file inside
    a .git/hooks/ directory. Git hooks execute automatically on git operations
    (commit, push, checkout, merge) for the lifetime of the repository clone —
    they persist long after the Claude session ends and run outside any sandbox.
    Writing a malicious pre-commit or post-checkout hook is a reliable persistence
    mechanism that survives agent restarts and is not visible in project source files.
    Asks rather than denies because legitimate use cases exist: setting up linters,
    formatters, or commit message validators via hook scripts.
  condition: is_git_hooks_write
  output: >
    Falco requires confirmation before writing a git hook at %tool.real_file_path
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, AML.T0043_craft_adversarial_data,
         mitre_t1546_event_triggered_execution]

- rule: Ask before writing package registry redirect
  desc: >
    Requires user confirmation when the agent writes or edits a package manager
    configuration file (.npmrc, .pypirc, pip.conf) with content that redirects
    package downloads to a custom registry or index. Once committed, a registry
    redirect causes every subsequent npm install, pip install, or yarn add in the
    project to download packages from the configured endpoint — a supply chain
    pivot where a single compromised package can inject malicious code into all
    future dependency installs. Legitimate corporate uses (Artifactory, Nexus,
    private PyPI) exist, so this rule asks rather than denies.
  condition: is_registry_config_write and is_registry_redirect_content
  output: >
    Falco requires confirmation before writing a package registry redirect to %tool.real_file_path
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, AML.T0010_ml_supply_chain_compromise,
         mitre_t1195_supply_chain_compromise]

- rule: Ask before API base URL override in environment file
  desc: >
    Requires user confirmation when the agent writes or edits an environment
    file (.env, .envrc, .env.local, etc.) with content that sets
    ANTHROPIC_BASE_URL, OPENAI_BASE_URL, or OPENAI_API_BASE. These variables
    redirect every API call made by the agent (and any application code that
    sources the file) through the specified endpoint. An attacker-controlled
    proxy at that URL can read all prompts and responses, inject malicious
    tool call results, or silently modify agent instructions in transit.
    Asks rather than denies because corporate proxies and self-hosted gateways
    (Anthropic-compatible endpoints, OpenAI-compatible inference servers) are
    legitimate uses — the user is the right party to confirm the endpoint.
  condition: is_env_file_write and is_api_base_url_override
  output: >
    Falco requires confirmation before %agent.name overrides an AI API base URL in %tool.real_file_path
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, AML.T0051_llm_prompt_injection,
         AML.T0037_llm_adversarial_example, mitre_t1565_data_manipulation]

- rule: Ask before writing AI API key to environment file
  desc: >
    Requires user confirmation when the agent writes or edits an environment file
    (.env, .envrc, .env.local, .env.staging, .env.test, etc.) with content containing
    an AI provider API key variable (ANTHROPIC_API_KEY, OPENAI_API_KEY, GEMINI_API_KEY).
    Writing the active API key to a file creates two risks: (1) the file may be
    committed to version control and exposed publicly, and (2) it stages the credential
    for exfiltration via a subsequent curl or upload command. Asks rather than denies
    because legitimate project setup workflows (creating .env.example, wiring up
    a new application) do write API key variable names to environment files.
  condition: is_env_file_write and is_api_key_in_env
  output: >
    Falco requires confirmation before %agent.name writes an AI API key variable to %tool.real_file_path
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, AML.T0037_llm_adversarial_example,
         mitre_t1552_unsecured_credentials]

- rule: Ask before Bash command accessing git hooks directory
  desc: >
    Requires user confirmation when a Bash command references a .git/hooks/
    directory path. Shell redirections (echo >, tee, cp, chmod +x) can write
    or activate persistent git hooks without using the Write or Edit tools,
    bypassing Rule 3. Git hooks execute automatically on git operations and
    persist long after the agent session ends. Asks rather than denies because
    legitimate devops tasks (installing pre-commit linters, auditing hooks)
    also involve referencing this path.
  condition: is_bash_git_hooks_write
  output: >
    Falco requires confirmation before a Bash command accesses the git hooks directory (%tool.input_command)
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, AML.T0043_craft_adversarial_data,
         mitre_t1546_event_triggered_execution]

- rule: Ask before Bash command redirecting package registry
  desc: >
    Requires user confirmation when a Bash command runs a package manager
    CLI-level registry redirect: npm config set registry, npm set registry,
    pip config set global.index-url, or pip config set global.extra-index-url.
    These commands modify the user's global package manager config, redirecting
    all future package installs to the specified endpoint. Unlike file writes
    (caught by Rule 4), these CLI commands modify config atomically via the
    package manager's own write path, bypassing Write/Edit tool detection.
  condition: tool.name = "Bash" and is_bash_registry_redirect
  output: >
    Falco requires confirmation before a Bash command redirects the package registry (%tool.input_command)
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, AML.T0010_ml_supply_chain_compromise,
         mitre_t1195_supply_chain_compromise]

# ===========================================================================
# Section 7: Self-protection — block agent attempts to disable Prempti.
#
# Prempti only sees agent-initiated tool calls; the user types `premptictl`
# directly in their own shell, never via a Bash tool call. So denying these
# patterns from the agent does not block legitimate user operations.
#
# Three rule families:
#   - any `premptictl` invocation (the CLI is user-facing only)
#   - platform service-stop alternatives, gated by agent.os
#   - writes/edits under the install prefix (rules, config, binaries) and
#     ~/.claude/settings.json, plus an ASK on reads of settings.json
# ===========================================================================

- macro: is_premptictl_invocation
  condition: is_bash and tool.input_command contains "premptictl"

- rule: Deny premptictl invocation
  desc: >
    Blocks any agent invocation of the premptictl CLI. premptictl is a
    user-facing tool — the user runs it directly in their own shell and
    never needs the coding agent to do it on their behalf. Denying every
    subcommand (stop / restart / disable / uninstall / daemon / hook /
    mode and the read-only status / health / logs commands) prevents
    service-disabling, reconfiguration, and reconnaissance through the
    Prempti control surface.
  condition: is_premptictl_invocation
  output: >
    Falco blocked an agent invocation of the premptictl CLI (%tool.input_command)
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, prempti_self_protection, mitre_t1562.001_impair_defenses_disable_or_modify_tools]

- macro: is_service_stop_linux
  condition: >
    agent.os = "linux" and is_bash and (
      tool.input_command contains "systemctl --user stop prempti"
      or tool.input_command contains "systemctl --user disable prempti"
      or tool.input_command contains "systemctl stop prempti"
      or tool.input_command contains "systemctl disable prempti"
      or tool.input_command contains "loginctl disable-linger"
      or tool.input_command contains "pkill falco"
      or tool.input_command contains "pkill -f falco"
      or tool.input_command contains "killall falco"
    )

- macro: is_service_stop_macos
  condition: >
    agent.os = "macos" and is_bash and (
      tool.input_command contains "launchctl unload"
        and tool.input_command contains "prempti"
      or tool.input_command contains "launchctl bootout"
        and tool.input_command contains "prempti"
      or tool.input_command contains "launchctl remove dev.falcosecurity.prempti"
      or tool.input_command contains "pkill falco"
      or tool.input_command contains "pkill -f falco"
      or tool.input_command contains "killall falco"
    )

- macro: is_service_stop_windows
  condition: >
    agent.os = "windows" and is_bash and (
      tool.input_command contains "taskkill"
        and tool.input_command contains "falco"
      or tool.input_command contains "Stop-Process"
        and tool.input_command contains "falco"
      or tool.input_command contains "Stop-Service"
        and tool.input_command contains "falco"
      or (tool.input_command contains "reg delete"
        and tool.input_command contains "Run"
        and tool.input_command contains "prempti")
    )

- rule: Deny service-stop alternatives targeting Prempti
  desc: >
    Blocks platform-specific commands that would stop Falco / unregister
    the Prempti service outside of the premptictl CLI: systemd stop /
    disable on Linux, launchctl unload / bootout on macOS, taskkill /
    Stop-Service / Run-key delete on Windows, plus pkill/killall variants
    against the falco process. Gated on agent.os so each pattern only
    fires on its native platform.
  condition: >
    is_service_stop_linux
    or is_service_stop_macos
    or is_service_stop_windows
  output: >
    Falco blocked a platform service-stop command targeting Prempti (%tool.input_command)
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, prempti_self_protection, mitre_t1562.001_impair_defenses_disable_or_modify_tools]

- macro: is_prempti_install_path
  condition: >
    (agent.os in (linux, macos) and tool.real_file_path contains "/.prempti/")
    or (agent.os = "windows"
        and tool.real_file_path icontains "/AppData/Local/prempti/")

# Claude Code reads both settings.json and settings.local.json from
# ~/.claude/ (and from project-level .claude/) with equal priority — hooks
# in either file fire. Match both so the self-protection deny can't be
# sidestepped by writing to the .local variant.
- macro: is_claude_settings_path
  condition: >
    tool.real_file_path endswith "/.claude/settings.json"
    or tool.real_file_path endswith "/.claude/settings.local.json"

- rule: Deny writes under Prempti install prefix
  desc: >
    Blocks Write/Edit on any path under the Prempti install prefix
    (~/.prempti/ on Unix, %LOCALAPPDATA%\\prempti\\ on Windows). This
    covers binaries, Falco and plugin config, the supervisor config,
    and both default and user rule files under rules/ — all of which
    govern how Prempti enforces policy. Reads are allowed so the agent
    can still introspect config / logs for debugging. Legitimate edits
    (custom rules, config changes) are user-driven: edit files under
    rules/user/ directly outside a coding session, then `premptictl
    restart` to apply.
  condition: is_write_tool and is_prempti_install_path
  output: >
    Falco blocked writing to %tool.real_file_path under the Prempti install prefix
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, prempti_self_protection, mitre_t1562.001_impair_defenses_disable_or_modify_tools]

- rule: Deny writes to Claude Code settings file
  desc: >
    Blocks Write/Edit on ~/.claude/settings.json. The Prempti hook lives
    here; modifying the file is the most direct way for an agent to
    unregister the interceptor. Use `premptictl hook` for legitimate
    hook lifecycle.
  condition: is_write_tool and is_claude_settings_path
  output: >
    Falco blocked writing to Claude Code settings at %tool.real_file_path
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, prempti_self_protection, mitre_t1562.001_impair_defenses_disable_or_modify_tools]

- rule: Deny writes to Claude Code policy limits file
  desc: >
    Blocks Write/Edit on ~/.claude/policy-limits.json. This file declares
    enforcement restrictions that Claude Code reads to decide which
    features are blocked or allowed (allow_remote_control,
    enforce_web_search_mcp_isolation, allow_quick_web_setup, etc.).
    Modifying it loosens the user's or MDM's intended security posture
    and could re-enable surfaces Prempti relies on the host to keep
    closed. Policy limits are configured by the user or an enterprise
    MDM; the agent has no legitimate reason to write here.
  condition: >
    is_write_tool
    and tool.real_file_path endswith "/.claude/policy-limits.json"
  output: >
    Falco blocked writing to Claude Code policy-limits.json at %tool.real_file_path
  priority: CRITICAL
  source: coding_agent
  tags: [coding_agent_deny, prempti_self_protection, mitre_t1562.001_impair_defenses_disable_or_modify_tools]

- rule: Ask before reading Claude Code settings file
  desc: >
    Asks before the agent reads ~/.claude/settings.json. The file is
    sensitive — it lists every hook the user has configured. Reads have
    legitimate uses (debugging hook registration), but the user should
    confirm.
  condition: tool.name = "Read" and is_claude_settings_path
  output: >
    Falco requires confirmation to read Claude Code settings at %tool.real_file_path
  priority: WARNING
  source: coding_agent
  tags: [coding_agent_ask, prempti_self_protection, mitre_t1562.001_impair_defenses_disable_or_modify_tools]