Safety decision 0105 · accepted
Every tip is scanned, and risky ones are held for review
A deterministic scanner flags dangerous commands, hidden text and injection attempts. Flagged tips never reach a repo or a session on their own.
Decision
stash scan checks tips when the index is built.
High-severity patterns hold a tip for review:
- piping a download into a shell
- decode-and-run
- recursive delete
- hidden text
- instruction-override phrases
- sending secrets or command output over the network
- disabling permission checks
Medium patterns (sudo, credential files, third-party MCP servers, unpinned npx -y, hooks) show as “check before applying”.
Tips held for review:
- never appear in matches, the weekly digests or the SessionStart hook. These rescan the tip files every time instead of trusting
index.json. /stash:applyshows the flags and asks first, and never runs a flagged command itself/stash:suggestlists them as “Held for review”
Consequences
The scanner is fast, predictable and tested with red-team fixtures. It complements the model’s judgment rather than replacing it, and the rules are easy to extend.