{"catalog_version":"1.98.0","license":"CC-BY-4.0","rules":[{"rule_id":"LH-01","rule_class":"loop_hygiene","description":"The job does not say what it is meant to accomplish.","check_logic":{"check":"loop_field_present","check_args":{"field":"goal"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI01"],"five_eyes_area":"behavioural","standards_note":null,"owasp_ast":[]},{"rule_id":"LH-02","rule_class":"loop_hygiene","description":"The job does not say how it can tell that it succeeded.","check_logic":{"check":"loop_field_present","check_args":{"field":"metric"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI10"],"five_eyes_area":"behavioural","standards_note":null,"owasp_ast":[]},{"rule_id":"LH-03","rule_class":"loop_hygiene","description":"The job does not say when it should stop running.","check_logic":{"check":"loop_field_present","check_args":{"field":"stop_condition"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI08","ASI10"],"five_eyes_area":"behavioural","standards_note":null,"owasp_ast":[]},{"rule_id":"LH-04","rule_class":"loop_hygiene","description":"The job does not set an upper bound on runs or cost.","check_logic":{"check":"loop_field_present","check_args":{"field":"limit"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI08","ASI02"],"five_eyes_area":"design_and_configuration","standards_note":null,"owasp_ast":[]},{"rule_id":"LH-05","rule_class":"loop_hygiene","description":"The job does not say what should happen when it fails.","check_logic":{"check":"loop_field_present","check_args":{"field":"on_failure"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI08"],"five_eyes_area":"design_and_configuration","standards_note":null,"owasp_ast":[]},{"rule_id":"BL-01","rule_class":"bloat","description":"The system instructions run past two hundred lines, not counting the blank ones.","check_logic":{"check":"system_instructions_line_limit","check_args":{"max_lines":200}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":[],"five_eyes_area":"none","standards_note":"Quality rule on the length of the instruction file; no ASI entry and no Five-Eyes risk area is named for it.","owasp_ast":[]},{"rule_id":"BL-02","rule_class":"bloat","description":"The same sentence appears more than once in the submission.","check_logic":{"check":"duplicate_sentence","check_args":{"min_words":6,"keep_digits":true,"one_per_sentence":true}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":[],"five_eyes_area":"none","standards_note":"Quality rule on repeated sentences; no ASI entry and no Five-Eyes risk area is named for it.","owasp_ast":[]},{"rule_id":"BL-03","rule_class":"bloat","description":"A skill's description is too short to say when it should be used.","check_logic":{"check":"skill_description_length","check_args":{"min_characters":20,"folded_description":true}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":[],"five_eyes_area":"none","standards_note":"Quality rule on the description a skill is chosen by; no ASI entry and no Five-Eyes risk area is named for it.","owasp_ast":[]},{"rule_id":"BL-04","rule_class":"bloat","description":"Two sentences give opposite instructions about the same thing.","check_logic":{"check":"contradiction","check_args":{"min_words":6}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI01"],"five_eyes_area":"behavioural","standards_note":null,"owasp_ast":[]},{"rule_id":"BL-05","rule_class":"bloat","description":"A component is empty, or shadowed by another one of the same kind and name, so the harness can never run it.","check_logic":{"check":"orphaned_component","check_args":{"components":["skill","subagent","command","rule_file"]}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":[],"five_eyes_area":"none","standards_note":"Notice on a component the harness can never run; no ASI entry and no Five-Eyes risk area is named for it.","owasp_ast":[]},{"rule_id":"PU-01","rule_class":"purpose","description":"No component says what the agent is meant to accomplish.","check_logic":{"check":"statement_present","check_args":{}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI01"],"five_eyes_area":"behavioural","standards_note":null,"owasp_ast":[]},{"rule_id":"AU-01","rule_class":"authority","description":"No component names a threshold at which the agent must involve a person before deciding, publishing or changing something further.","check_logic":{"check":"authority_ask_present","check_args":{"local_settings":true,"permission_table_version":"1.8.0","table_version":"1.17.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI02","ASI03"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":["AST03"]},{"rule_id":"AU-02","rule_class":"authority","description":"No component names something the agent must never do on its own.","check_logic":{"check":"authority_deny_present","check_args":{"local_settings":true,"action_list_version":"1.1.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI02","ASI03"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":["AST03"]},{"rule_id":"ST-01","rule_class":"state","description":"No component says which parts of memory carry over between runs and which start fresh each run.","check_logic":{"check":"statement_present","check_args":{}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI06"],"five_eyes_area":"design_and_configuration","standards_note":null,"owasp_ast":[]},{"rule_id":"ST-02","rule_class":"state","description":"No component names something the agent deliberately does not keep beyond a single run.","check_logic":{"check":"statement_present","check_args":{}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI06"],"five_eyes_area":"design_and_configuration","standards_note":null,"owasp_ast":[]},{"rule_id":"RU-01","rule_class":"rules","description":"No component without its own loop names a limit on how often or how fast it may act.","check_logic":{"check":"statement_present","check_args":{"permission_table_version":"1.8.0","table_version":"1.17.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI08","ASI02"],"five_eyes_area":"design_and_configuration","standards_note":null,"owasp_ast":[]},{"rule_id":"RU-02","rule_class":"rules","description":"No component gives guidance on the tone or wording the agent should use toward people.","check_logic":{"check":"statement_present","check_args":{}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI09"],"five_eyes_area":"behavioural","standards_note":null,"owasp_ast":[]},{"rule_id":"HA-01","rule_class":"handoffs","description":"No component names a condition under which the agent stops and hands the task to a person instead of continuing.","check_logic":{"check":"statement_present","check_args":{"permission_table_version":"1.8.0","table_version":"1.17.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI10"],"five_eyes_area":"accountability","standards_note":null,"owasp_ast":[]},{"rule_id":"HA-02","rule_class":"handoffs","description":"No component says how a refusal or an escalation is recorded so a person can find it afterward.","check_logic":{"check":"statement_present","check_args":{}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI10"],"five_eyes_area":"accountability","standards_note":null,"owasp_ast":[]},{"rule_id":"TE-01","rule_class":"tests","description":"No component names a case the agent's behavior has been checked against.","check_logic":{"check":"test_case_present","check_args":{}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI10"],"five_eyes_area":"accountability","standards_note":null,"owasp_ast":[]},{"rule_id":"TE-02","rule_class":"tests","description":"No component names a check the agent runs before it reports a task as done (tests, a build, a linter or a review), and no hook handler is configured on an event at which the harness lets a hook act before the agent ends its turn.","check_logic":{"check":"tests_check_or_hook_present","check_args":{"table_version":"1.12.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI10"],"five_eyes_area":"accountability","standards_note":null,"owasp_ast":[]},{"rule_id":"EX-01","rule_class":"exceptions","description":"No component says what the agent does if it notices it is already running or already finished this task.","check_logic":{"check":"statement_present","check_args":{"scope":"submission"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI08"],"five_eyes_area":"design_and_configuration","standards_note":null,"owasp_ast":[]},{"rule_id":"EX-02","rule_class":"exceptions","description":"No component says what happens when two of its own instructions point in different directions.","check_logic":{"check":"statement_present","check_args":{}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI01"],"five_eyes_area":"behavioural","standards_note":null,"owasp_ast":[]},{"rule_id":"EX-03","rule_class":"exceptions","description":"The package defines at least one subagent and no `env` entry of its settings sets `CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH`, so the nesting depth of subagents follows a default of the provider, which can change with a new version.","check_logic":{"check":"exceptions_subagent_depth_unset","check_args":{"table_version":"1.14.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI08"],"five_eyes_area":"design_and_configuration","standards_note":null,"owasp_ast":[]},{"rule_id":"NW-01","rule_class":"network","description":"The model endpoint points at a public model API host and no gateway or proxy is configured in between.","check_logic":{"check":"network_public_endpoint","check_args":{"table_version":"1.17.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI04"],"five_eyes_area":"design_and_configuration","standards_note":null,"owasp_ast":[]},{"rule_id":"NW-02","rule_class":"network","description":"The egress allow-list is missing, empty, contains a wildcard entry or is not applied because the sandbox is not switched on, so the agent may reach any host.","check_logic":{"check":"network_egress_allowlist","check_args":{"table_version":"1.17.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI02"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":["AST06"]},{"rule_id":"NW-03","rule_class":"network","description":"No upper bound on cost or requests is configured for model calls, so nothing stops a runaway run.","check_logic":{"check":"network_cost_bound","check_args":{"table_version":"1.17.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI08","ASI02"],"five_eyes_area":"design_and_configuration","standards_note":null,"owasp_ast":[]},{"rule_id":"NW-04","rule_class":"network","description":"A remote tool or MCP endpoint is configured over plain http://, so the traffic goes in clear text and can be read and changed on the way.","check_logic":{"check":"network_plain_http_tool","check_args":{"table_version":"1.17.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI07"],"five_eyes_area":"structural","standards_note":null,"owasp_ast":[]},{"rule_id":"NW-05","rule_class":"network","description":"The package holds no field of the Netzwerk detection table for its harness, so how it reaches the model and its tools cannot be judged statically. Default model endpoints are not visible to a static check. Fields the harness does not read are not in the table and are not judged.","check_logic":{"check":"network_not_checkable","check_args":{"table_version":"1.17.0","notice_location":"none"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":[],"five_eyes_area":"none","standards_note":"Notice that the check has no field of the detection table for the harness; it limits the check, it answers no risk of the two standards.","owasp_ast":[]},{"rule_id":"NW-06","rule_class":"network","description":"The model endpoint or proxy field names a host that is not on the list of public model API hosts. A static check cannot tell your own gateway from a foreign host.","check_logic":{"check":"network_unverified_host","check_args":{"table_version":"1.17.0","permission_table_version":"1.8.0","unless_second_place":true}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":[],"five_eyes_area":"none","standards_note":"Notice on a model host that is not on the list of public model API hosts; it limits the check, it answers no risk of the two standards.","owasp_ast":[]},{"rule_id":"NW-13","rule_class":"network","description":"The model endpoint or proxy field names a host that is not on the list of public model API hosts, and the package also leaves the egress open (the allow-list is absent, empty, holds a wildcard or is not applied) or lets every shell command run without the approval of a person. Together they are a configured path for your key and your traffic to a host nobody confirmed.","check_logic":{"check":"network_foreign_host_second_place","check_args":{"table_version":"1.17.0","permission_table_version":"1.8.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI02"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":["AST06"]},{"rule_id":"NW-07","rule_class":"network","description":"A tool server, a hook handler, a shell script of a skill or a script a hook calls starts or installs a package without an exact version, so it runs whatever the registry serves at the next start.","check_logic":{"check":"network_unpinned_package","check_args":{"table_version":"1.17.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI04"],"five_eyes_area":"structural","standards_note":null,"owasp_ast":["AST02","AST07"]},{"rule_id":"AU-03","rule_class":"authority","description":"An allow entry matches every shell command, so the agent runs shell commands without the approval of a person, whatever its instructions say.","check_logic":{"check":"authority_every_command_allowed","check_args":{"table_version":"1.15.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI02","ASI03"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":["AST03"]},{"rule_id":"AU-04","rule_class":"authority","description":"The default permission mode skips the prompts, but the harness does not take it from the settings file of a package.","check_logic":{"check":"authority_mode_without_effect","check_args":{"table_version":"1.8.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI03"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":[]},{"rule_id":"AU-05","rule_class":"authority","description":"The package configures hook handlers. A hook can answer a permission request in place of the person, and a static check does not read what a hook does or decides.","check_logic":{"check":"authority_hook_notice","check_args":{"table_version":"1.17.0","hook_script_limits":true}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI03","ASI05"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":["AST03"]},{"rule_id":"RU-03","rule_class":"rules","description":"The package holds text files that are neither German nor English. The rules that search for a statement read these two languages only, so they cannot judge those files.","check_logic":{"check":"language_notice","check_args":{}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":[],"five_eyes_area":"none","standards_note":"Notice on text files in a language the statement rules cannot read; it limits the check, it answers no risk of the two standards.","owasp_ast":[]},{"rule_id":"NW-08","rule_class":"network","description":"A tool server is declared, the egress allow-list is absent, empty, holds a wildcard or is not applied because the sandbox is not switched on, and a setting lets shell commands or all tools of a tool server run without the approval of a person. Together they are a configured way out for data.","check_logic":{"check":"network_open_path","check_args":{"table_version":"1.17.0","permission_table_version":"1.8.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI02","ASI04"],"five_eyes_area":"structural","standards_note":null,"owasp_ast":["AST02","AST06"]},{"rule_id":"BL-06","rule_class":"bloat","description":"One sentence negates the phrase of a rule and another sentence meets the same rule, so the two may contradict each other. A word list cannot tell whether they do.","check_logic":{"check":"statement_contradiction","check_args":{}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":[],"five_eyes_area":"none","standards_note":"Notice on possibly contradicting sentences; no ASI entry and no Five-Eyes risk area is named for it.","owasp_ast":[]},{"rule_id":"BL-07","rule_class":"bloat","description":"A skill's description names no situation in which the skill applies, and the description is the only thing the agent reads to decide whether to load it.","check_logic":{"check":"skill_trigger_missing","check_args":{"min_characters":20,"triggers_version":"1.0.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":[],"five_eyes_area":"none","standards_note":"Quality rule on the situation a skill description names; no ASI entry and no Five-Eyes risk area is named for it.","owasp_ast":[]},{"rule_id":"BL-08","rule_class":"bloat","description":"A skill's body runs over 500 lines, or its description over 100 words, so the skill is loaded whole or read badly as a trigger.","check_logic":{"check":"skill_body_length","check_args":{"max_lines":500,"max_description_words":100}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":[],"five_eyes_area":"none","standards_note":"Quality rule on the size of a skill; no ASI entry and no Five-Eyes risk area is named for it.","owasp_ast":[]},{"rule_id":"BL-09","rule_class":"bloat","description":"A skill names a file or directory that the package does not contain, so the agent is sent to a place that is not there.","check_logic":{"check":"skill_dangling_reference","check_args":{}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":[],"five_eyes_area":"none","standards_note":"Quality rule on a file a skill names that the package lacks; no ASI entry and no Five-Eyes risk area is named for it.","owasp_ast":[]},{"rule_id":"BL-10","rule_class":"bloat","description":"The name in the skill's frontmatter differs from the name of the skill's directory, so the skill is known under two names.","check_logic":{"check":"skill_name_directory","check_args":{}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":[],"five_eyes_area":"none","standards_note":"Notice on a skill name that differs from its directory; no ASI entry and no Five-Eyes risk area is named for it.","owasp_ast":["AST04"]},{"rule_id":"PU-02","rule_class":"purpose","description":"No component says what the agent does with a task outside its purpose.","check_logic":{"check":"statement_present","check_args":{}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI01"],"five_eyes_area":"behavioural","standards_note":null,"owasp_ast":[]},{"rule_id":"RU-04","rule_class":"rules","description":"The package declares a tool server, and no component says that content from tools and fetched pages is data and never an instruction.","check_logic":{"check":"statement_present","check_args":{"requires_tool_server":true,"table_version":"1.17.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI01"],"five_eyes_area":"behavioural","standards_note":null,"owasp_ast":["AST05"]},{"rule_id":"AU-06","rule_class":"authority","description":"A sentence of a component text lifts the agent's limits (\"you have no restrictions\", \"never refuse\", \"ignore previous instructions\").","check_logic":{"check":"jailbreak_phrase","check_args":{"phrases_version":"1.1.0","qualifiers_version":"1.0.0","min_words":2,"soft_line_breaks":true,"limits_version":"1.1.0","language_bound":true}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI01"],"five_eyes_area":"behavioural","standards_note":null,"owasp_ast":[]},{"rule_id":"RU-05","rule_class":"rules","description":"A line of a component text holds an internal host name, a private address or a file path. In an instruction that is often meant, and a text that is passed on may carry it past the inside of a setup.","check_logic":{"check":"internal_reference_text","check_args":{"card_protocol_version":"0.3","card_table_version":"1.1.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":[],"five_eyes_area":"design_and_configuration","standards_note":"No ASI entry names an internal host, a private address or a path in an instruction text; the Five-Eyes area is the configuration that carries them.","owasp_ast":[]},{"rule_id":"RU-06","rule_class":"rules","description":"One sentence holds the phrases of three or more different statement rules, such as the threshold, the rate limit and the audit trail. The check counts such a sentence for none of them, because a list of keywords states no control.","check_logic":{"check":"phrase_accumulation","check_args":{}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":[],"five_eyes_area":"none","standards_note":"Notice on a sentence that piles up the phrases of several rules; it limits the check, it answers no risk of the two standards.","owasp_ast":[]},{"rule_id":"RU-07","rule_class":"rules","description":"A line of a text file holds an invisible or direction-control character, or a word that mixes Latin letters with Cyrillic or Greek ones. The check reads the text without these characters, names file, line and code points, and maps a mixed word to nothing.","check_logic":{"check":"obfuscation_notice","check_args":{"invisible_characters_version":"1.0.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":[],"five_eyes_area":"none","standards_note":"Notice on characters a person cannot see in a text file; it limits the check, it answers no risk of the two standards.","owasp_ast":[]},{"rule_id":"NW-09","rule_class":"network","description":"A hook (its command in the settings, or a script it calls) or a script of a skill fetches code from the network and runs it at once (a download piped into a shell or an interpreter, or saved and run in the same line), so the setup executes whatever the address serves at that moment.","check_logic":{"check":"network_download_and_run","check_args":{"table_version":"1.22.0","skill_script_limits":true}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI04","ASI05"],"five_eyes_area":"structural","standards_note":null,"owasp_ast":["AST01","AST02"]},{"rule_id":"NW-14","rule_class":"network","description":"A sentence in the text of a skill tells the agent to fetch code or instructions from a network address at run time and to follow or run what it gets, so whoever controls that address controls what the skill makes the agent do.","check_logic":{"check":"skill_fetch_and_follow","check_args":{"phrases_version":"1.0.0","min_words":3,"language_bound":true,"frontmatter_comments":true,"frontmatter_scan":true}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI01","ASI04","ASI05"],"five_eyes_area":"structural","standards_note":null,"owasp_ast":["AST02","AST05"]},{"rule_id":"NW-15","rule_class":"network","description":"The settings add a plugin marketplace or enable a plugin from a source that is not on the published list of official sources. A static check cannot tell whether the source is trustworthy; skills and plugins are code that runs with the rights of the agent.","check_logic":{"check":"network_plugin_source","check_args":{"table_version":"1.22.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI04"],"five_eyes_area":"structural","standards_note":null,"owasp_ast":["AST02"]},{"rule_id":"AU-07","rule_class":"authority","description":"A hook (its command in the settings, or a script it calls) deletes recursively the whole of the root, the home directory, the project directory or a system path, with no person asked.","check_logic":{"check":"authority_dangerous_delete","check_args":{"table_version":"1.17.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI05"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":["AST01"]},{"rule_id":"AU-08","rule_class":"authority","description":"A hook command names a script that is not part of the submission, so the check cannot read what the hook does.","check_logic":{"check":"authority_hook_script_missing","check_args":{"table_version":"1.17.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI05"],"five_eyes_area":"structural","standards_note":null,"owasp_ast":[]},{"rule_id":"ST-03","rule_class":"state","description":"The settings of Codex CLI let every command of the agent inherit the whole environment of the process that started it, with no filter, so tokens, keys and other secrets in that environment are visible to every command.","check_logic":{"check":"state_environment_inherited","check_args":{"table_version":"1.17.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI03"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":["AST06"]},{"rule_id":"AU-09","rule_class":"authority","description":"The sandbox of Codex CLI may write to the root, the home directory or a system path as a whole, so a command of the agent can change or delete files far beyond the project.","check_logic":{"check":"authority_wide_writable_root","check_args":{"table_version":"1.17.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI02","ASI03"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":["AST03","AST06"]},{"rule_id":"NW-10","rule_class":"network","description":"The settings of Codex CLI let the agent search the live web, so text from any site can reach its context during a run.","check_logic":{"check":"network_web_search_live","check_args":{"table_version":"1.17.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI01"],"five_eyes_area":"design_and_configuration","standards_note":null,"owasp_ast":["AST05"]},{"rule_id":"AU-10","rule_class":"authority","description":"A tool server in the settings of Gemini CLI has `trust` set to `true`, so the harness runs every tool of that server, also one added later, without asking the person.","check_logic":{"check":"authority_server_trust","check_args":{"table_version":"1.17.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI02","ASI03"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":["AST03"]},{"rule_id":"AU-11","rule_class":"authority","description":"A tool server in the settings of Gemini CLI has `trust` set to `true`, or the approval mode is `auto_edit`, and the settings do not switch the sandbox on, so the harness runs calls without a confirmation and without a sandbox around the agent.","check_logic":{"check":"authority_trust_without_sandbox","check_args":{"table_version":"1.20.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI02","ASI03"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":["AST03","AST06"]},{"rule_id":"AU-12","rule_class":"authority","description":"The commands of the shell tool of Gemini CLI are limited only by entries in the exclusion list, which blocks known commands and lets every other command through; the documentation of the harness recommends an allowlist.","check_logic":{"check":"authority_shell_blocklist_only","check_args":{"table_version":"1.17.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI02","ASI03"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":["AST06"]},{"rule_id":"AU-13","rule_class":"authority","description":"The settings let the agent fetch pages, search the web or use a whole tool server without asking, and no hook handler stands on the event before or after a tool call with a matcher that covers that tool, so whatever comes back reaches the agent with nothing in between.","check_logic":{"check":"authority_outside_content_unguarded","check_args":{"table_version":"1.21.0","permission_table_version":"1.12.0","outside_content_tools_version":"1.0.0","outward_actions_version":"1.1.0","read_only_marks":true}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI01","ASI02"],"five_eyes_area":"behavioural","standards_note":null,"owasp_ast":["AST05"]},{"rule_id":"AU-17","rule_class":"authority","description":"The settings allow without asking both a tool that brings outside content into the context (web fetch, web search, a whole tool server) and a command or tool that acts outward (`git push`, `gh pr create`, `gh issue create`, `npm publish`, sending mail, a whole tool server), so a text injected into the content can start the outward action with nobody asked.","check_logic":{"check":"authority_outside_content_and_outward","check_args":{"table_version":"1.21.0","permission_table_version":"1.15.0","outside_content_tools_version":"1.0.0","outward_actions_version":"1.1.0","read_only_marks":true}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI01","ASI02"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":["AST05"]},{"rule_id":"AU-18","rule_class":"authority","description":"The settings hold no deny entry for reading at least one of the paths that usually hold credentials (`~/.ssh`, `~/.aws`, `.env` and others), so the agent may read these files like any other file.","check_logic":{"check":"authority_credential_paths_denied","check_args":{"permission_table_version":"1.12.0","credential_paths_version":"1.0.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI02","ASI03"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":["AST03"]},{"rule_id":"AU-19","rule_class":"authority","description":"A settings file that travels with the repository sets `enableAllProjectMcpServers` to `true`, so every tool server that the `.mcp.json` of the repository defines starts for everyone who opens it, with no person approving it.","check_logic":{"check":"authority_project_approves_all_servers","check_args":{"permission_table_version":"1.13.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI04","ASI05"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":["AST02"]},{"rule_id":"AU-20","rule_class":"authority","description":"A settings file that travels with the repository lists in `enabledMcpjsonServers` a tool server that the `.mcp.json` of the repository defines, so that server starts for everyone who opens the repository, with no person approving it.","check_logic":{"check":"authority_project_approves_listed_servers","check_args":{"permission_table_version":"1.13.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI04","ASI05"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":["AST02"]},{"rule_id":"AU-21","rule_class":"authority","description":"An allow entry of the settings lets a command run that installs a package by name without asking, so the agent installs whatever package a prompt or the model names, with no person looking at the name first.","check_logic":{"check":"authority_installs_by_name_allowed","check_args":{"table_version":"1.13.0","install_by_name_version":"1.1.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI02","ASI04"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":["AST02"]},{"rule_id":"NW-16","rule_class":"network","description":"The description or the input schema of a tool differs from the one the last earlier submission of the same agent held for the same tool server and tool name, so the tool is not what was allowed when it was last read.","check_logic":{"check":"network_tool_description_changed","check_args":{"requires_file":"tool-descriptions.json","requires_history":true}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI01","ASI04"],"five_eyes_area":"structural","standards_note":null,"owasp_ast":["AST02","AST07"]},{"rule_id":"AU-14","rule_class":"authority","description":"The settings of Gemini CLI set the approval mode `auto_edit`, so the harness approves the edit tools (`replace`, `write_file`) on its own and asks only for the other tools.","check_logic":{"check":"authority_edits_auto_approved","check_args":{"table_version":"1.20.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI02","ASI03"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":["AST03"]},{"rule_id":"AU-15","rule_class":"authority","description":"The settings allow a command that deletes or overwrites for good without asking, so the agent runs it without a person looking at it first.","check_logic":{"check":"authority_destructive_allowed","check_args":{"table_version":"1.11.0","commands_version":"1.0.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI02","ASI03"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":["AST03"]},{"rule_id":"AU-16","rule_class":"authority","description":"The settings allow shell commands without asking, and nothing stands in the way of a destructive command: no entry denies or asks for one, and no hook runs before the shell tool.","check_logic":{"check":"authority_destructive_unguarded","check_args":{"table_version":"1.15.0","permission_table_version":"1.15.0","network_table_version":"1.17.0","commands_version":"1.0.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI02","ASI03"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":["AST03"]},{"rule_id":"LH-06","rule_class":"loop_hygiene","description":"A loop or wrapper script starts Gemini CLI or Codex CLI with an option that approves every action, so the agent runs without asking the person at any step of the loop.","check_logic":{"check":"loop_approve_all_flag","check_args":{"table_version":"1.17.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI02","ASI08"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":["AST03"]},{"rule_id":"LH-07","rule_class":"loop_hygiene","description":"A loop or wrapper script starts Claude Code with an option that switches off every permission prompt, so the agent runs without asking the person at any step of the loop.","check_logic":{"check":"loop_approve_all_flag","check_args":{"table_version":"1.19.0","programs":["claude"]}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI02","ASI08"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":["AST03"]},{"rule_id":"NW-11","rule_class":"network","description":"A tool server is started through a package runner with a package that names no registry scope and no git source, so nothing in the setup says whose package it is and a look-alike name would start just as well.","check_logic":{"check":"network_unknown_package_origin","check_args":{"table_version":"1.17.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI04"],"five_eyes_area":"structural","standards_note":null,"owasp_ast":["AST02"]},{"rule_id":"NW-12","rule_class":"network","description":"The command of a tool server or of a hook handler calls a program that makes a network connection (`curl`, `wget`, `nc` or `ssh`), so the setup reaches out to a host each time the server or the hook starts.","check_logic":{"check":"network_call_in_command","check_args":{"table_version":"1.17.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI02"],"five_eyes_area":"structural","standards_note":null,"owasp_ast":["AST02"]},{"rule_id":"TD-01","rule_class":"authority","description":"The description of a tool tells the agent to ignore the user, earlier instructions or the other tools, so the agent may follow the tool instead of the person it works for.","check_logic":{"check":"tool_description_form","check_args":{"form":"ignore","patterns_version":"1.0.0","negation_words_version":"1.2.0","requires_file":"tool-descriptions.json"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI01","ASI02"],"five_eyes_area":"behavioural","standards_note":null,"owasp_ast":["AST01","AST04"]},{"rule_id":"TD-02","rule_class":"authority","description":"The description of a tool tells the agent to keep an output or an action from the user, so the person the agent works for does not see what the tool does.","check_logic":{"check":"tool_description_form","check_args":{"form":"hide","patterns_version":"1.0.0","negation_words_version":"1.2.0","requires_file":"tool-descriptions.json"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI01","ASI09"],"five_eyes_area":"accountability","standards_note":null,"owasp_ast":["AST01","AST04"]},{"rule_id":"TD-03","rule_class":"authority","description":"The description of a tool tells the agent to read a file or a secret that a tool has no business with (a key file, a credentials file, the credentials of the user), so the tool can have them passed to it.","check_logic":{"check":"tool_description_form","check_args":{"form":"read","patterns_version":"1.0.0","negation_words_version":"1.2.0","requires_file":"tool-descriptions.json"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI02","ASI03"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":["AST01","AST04"]},{"rule_id":"DT-01","rule_class":"handoffs","description":"An answer of the questionnaire puts sending e-mail outside the company, posting in Slack or Teams, or purchases and payments at the level \"act without asking\", so the Dot sends or pays without a person agreeing first.","check_logic":{"check":"dots_questionnaire","check_args":{"condition":"external_actions","questionnaire_schema_version":"1.0.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI02","ASI09"],"five_eyes_area":"accountability","standards_note":null,"owasp_ast":[]},{"rule_id":"DT-02","rule_class":"authority","description":"The answers put changing, sharing or deleting files at the level \"act without asking\" while the Dot may write in the file storage, so it can change or remove files without a person agreeing first.","check_logic":{"check":"dots_questionnaire","check_args":{"condition":"files_without_asking","questionnaire_schema_version":"1.0.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI02","ASI03"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":[]},{"rule_id":"DT-03","rule_class":"authority","description":"The answers say that sign-in with stored passwords is switched on for banks or public authorities, so the Dot can sign in where a mistake costs money or has legal effect.","check_logic":{"check":"dots_questionnaire","check_args":{"condition":"stored_passwords_banks","questionnaire_schema_version":"1.0.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI03"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":[]},{"rule_id":"DT-04","rule_class":"loop_hygiene","description":"The answers say that a scheduled task has a writing action and that no person reviews its results before they take effect, so the Dot writes on a timetable without anyone looking.","check_logic":{"check":"dots_questionnaire","check_args":{"condition":"unreviewed_schedule","questionnaire_schema_version":"1.0.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI02","ASI08"],"five_eyes_area":"behavioural","standards_note":null,"owasp_ast":[]},{"rule_id":"DT-05","rule_class":"authority","description":"The answers say that other persons than the owner can give the Dot tasks while a writing action is at the level \"act without asking\", so a person without authority can make the Dot write.","check_logic":{"check":"dots_questionnaire","check_args":{"condition":"others_give_tasks","questionnaire_schema_version":"1.0.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI01","ASI03"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":[]},{"rule_id":"DT-06","rule_class":"authority","description":"The answers say that the Dot has access to the own computer, which gives it reach over local files and programs beyond the connected apps.","check_logic":{"check":"dots_questionnaire","check_args":{"condition":"own_computer","questionnaire_schema_version":"1.0.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI02","ASI03"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":[]},{"rule_id":"DT-07","rule_class":"authority","description":"The answers say that Codex cloud environments are connected with network access, so code the Dot starts there can reach the network.","check_logic":{"check":"dots_questionnaire","check_args":{"condition":"codex_cloud_network","questionnaire_schema_version":"1.0.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI02","ASI05"],"five_eyes_area":"design_and_configuration","standards_note":null,"owasp_ast":[]},{"rule_id":"DT-08","rule_class":"state","description":"The answers say that personal customer data are processed, or that it is not known, so the Dot may handle data whose protection nobody has checked.","check_logic":{"check":"dots_questionnaire","check_args":{"condition":"customer_data","questionnaire_schema_version":"1.0.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":[],"five_eyes_area":"none","standards_note":"Data protection is not an entry of the OWASP list or a risk area of the Five-Eyes guidance; no ASI entry and no area is named for it.","owasp_ast":[]},{"rule_id":"DT-09","rule_class":"authority","description":"The answers give the Dot write access in more than three kinds of app. The check counts kinds of app, not single apps.","check_logic":{"check":"dots_questionnaire","check_args":{"condition":"many_write_apps","questionnaire_schema_version":"1.0.0"}},"cross_references":[],"report_count":null,"operator_count":null,"owasp_asi":["ASI02","ASI03"],"five_eyes_area":"privilege","standards_note":null,"owasp_ast":[]}]}