catpilot-guardrails

Plugin catpilot-guardrails from marketplace catpilot in catpilotai/catpilot-ai-guardrails. Commands read from the repo's manifest — 14 days ago.

Skills (25)

• catpilot-agentic-security

  Catpilot''s security and reliability baseline for autonomous, scheduled, and multi-agent harnesses (LangGraph, CrewAI, OpenAI Agents SDK, Claude Agent SDK, custom MCP servers, and bespoke Python loops): advisory guardrails across five components: tool-execution sandboxing, memory and identity integr

• catpilot-safe-building

  Plain-language security guidance for anyone building an app, automation, dashboard, or data tool with an AI assistant, whether or not they can read code. Use whenever the conversation is about building, connecting, deploying, or sharing something that touches company data or company systems. Eight c

• catpilot-security-core

  Catpilot''s universal AI-coding-agent security baseline: advisory guardrails across nine components: cloud CLI mutations, database state changes, local CLI destruction, Docker container builds, hardcoded secrets, secrets management, supply-chain integrity, PII / test-data hygiene, and language-agnos

• cron-idempotency

  Secure unsupervised scheduled agent runs (crons) with strict timeouts, read-only tool scopes, atomic work-claim markers, and provider-side idempotency keys on every external side effect.

• loop-discipline

  Bound agent tool loops with hard retry caps, external-state verifiers, shared workflow retry budgets, mandatory state invalidation after mutating calls, exponential-backoff tool health probes, and pass@1 evaluation.

• memory-and-identity

  Isolate agent memory per user and session, redact secrets and PII before persisting to memory or logs, delineate untrusted RAG/tool context from instructions, and verify SHA-256 hashes of agent identity files at session start.

• multi-agent-auth

  Authenticate inter-agent calls with bearer tokens, enforce explicit target-agent allowlists, verify message provenance, prevent privilege escalation on delegation, and cap delegation depth and ping-pong turns.

• tool-sandboxing

  Constrain agent shell, file, and network tools with explicit command allowlists, symlink-resolved workspace path confinement, DNS-resolved SSRF and metadata-endpoint blocking, and human-in-the-loop approval for destructive actions.

• cloud-cli-safety

  Require query-before-modify, full-command display, explicit confirmation, and rollback preparation before any cloud CLI invocation that mutates infrastructure. Covers Azure (`az`), AWS (`aws`), GCP (`gcloud`, `gsutil`), Kubernetes (`kubectl`, `helm`), and Terraform/IaC (`terraform`). Born from a rea

• database-safety

  Require preview-before-modify, row-count disclosure, transactional execution, and rollback preparation before any SQL or ORM operation that mutates data or schema. Block destructive statements without a WHERE clause, schema drops without confirmation, prod migrations without dry-run, and raw string

• docker-safety

  Block container runtime escape paths, root-by-default images, build-time secrets baked into layers, and supply-chain risks from floating base tags before they reach a registry or a host. Require non-root `USER`, digest-pinned base images, BuildKit secret mounts (never `ENV`/`ARG` for secrets), `--no

• language-baseline

  Block the language-agnostic classes of injection and arbitrary-code-execution failures — SQL via string concatenation, command injection via shell-true subprocess calls, XSS via `innerHTML`/`document.write`, path traversal via unvalidated filenames, insecure deserialization (`pickle`, unsafe `yaml.l

• local-cli-safety

  Block irreversible filesystem operations, history-destroying git commands on shared branches, network exposure to non-loopback interfaces, world-readable credential paths, and credential exfiltration patterns before they run on a developer or CI machine. Covers `rm`/`find -delete`/`dd`/`chmod -R`, `

• pii-and-test-data

  Block real customer data from appearing in test fixtures, code comments, documentation, debug output, or shared transcripts. Require synthetic generators (`faker`, `@faker-js/faker`, provider test cards), reserved test ranges (555 phone numbers, `@example.com` emails, RFC 5737 IPs), and redaction of

• secret-blocking

  Detects and blocks hardcoded secrets — API keys, tokens, private keys, and database connection strings — before they are written to disk, committed to git, or echoed to logs. Covers 40+ patterns across Stripe, AWS, GitHub, GitLab, OpenAI, Anthropic, Slack, Google, SendGrid, Mailgun, Square, Twilio,

• secrets-management

  Govern how secrets are stored, scoped, distributed, rotated, and surfaced to running code — never committed `.env` files, never echoed in CI logs, never embedded in URLs or error messages, never shared across environments. Complements `secret-blocking` (which detects hardcoded patterns at write time

• supply-chain

  Block typosquats, unpinned dependencies, floating GitHub Actions tags, `curl | bash` installs, unverified agent skills/MCP servers, and post-install scripts from unknown publishers before they reach a developer machine, a CI runner, or a production image. Require lockfile-based installs, SHA-pinned

• access-and-identity

  Default every app to the company's own sign-in and the smallest audience that needs it. Ask who should be able to open it, and flag public links, shared passwords, and everyone-can-see settings before they are chosen.

• data-in-prompts

  Before any real information goes into a prompt, a file upload, or a test, help the person use made-up or masked data instead. Refuse to continue with card numbers, government IDs, health records, or credentials, and say why in one sentence.

• hosting-and-where-it-runs

  Ask where the finished app, automation, or dashboard will live before it is built, and steer to the company's approved hosting. Flag personal accounts, free tiers, trial workspaces, and unmanaged servers.

• keys-and-credentials

  Never let a password, API key, token, or connection string be pasted into a prompt, a file, or generated code. Use the company's approved way to connect, use obvious placeholders in examples, and treat anything already pasted as exposed.

• sharing-and-publishing

  Before anything is published, shared, embedded, or sent, check for company data in the output, public link settings, and screenshots that leak. Start with a small private preview and keep a way back to the last working version.

• third-party-services

  Treat any new software service, plugin, connector, extension, or AI model endpoint as an approval question, not a convenience. Check the company's approved list first, and explain in one sentence what a new service would receive.

• untrusted-input

  If the app takes input from people, documents, emails, or web pages, treat that input as untrusted. The app follows the company's instructions, never the input's; user text never becomes a raw command; and blank, wrong, or unusual entries get a calm, helpful response.

• when-to-ask-a-human

  Explicit triggers to stop and ask for a security review, including real customer or employee data, external users, payments, health data, anything that writes to a system of record, and anything the person cannot explain. Give the person a two-sentence summary to send.

Similar plugins