clawdstrike 0.2.5

Security guards and policy engine for AI agent execution
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142

# AI Agent Ruleset
# Optimized for AI coding assistants (Claude, GPT, etc.)
version: "1.1.0"
name: AI Agent
description: Security rules optimized for AI coding assistants

guards:
  forbidden_path:
    patterns:
      # Core sensitive paths
      - "**/.ssh/**"
      - "**/id_rsa*"
      - "**/id_ed25519*"
      - "**/.aws/**"
      - "**/.env"
      - "**/.env.local"
      - "**/.env.production"
      - "**/.git-credentials"
      - "**/.gnupg/**"
      - "**/.kube/**"
      - "**/.docker/**"
      - "**/.npmrc"
      - "/etc/shadow"
      - "/etc/passwd"
      # Windows credential stores
      - "**/AppData/Roaming/Microsoft/Credentials/**"
      - "**/AppData/Local/Microsoft/Credentials/**"
      - "**/AppData/Roaming/Microsoft/Vault/**"
      # Windows registry hives
      - "**/NTUSER.DAT"
      - "**/Windows/System32/config/SAM"
      - "**/Windows/System32/config/SECURITY"
      - "**/Windows/System32/config/SYSTEM"
    exceptions:
      # Allow reading .env.example for documentation
      - "**/.env.example"
      - "**/.env.template"

  egress_allowlist:
    allow:
      # AI APIs
      - "*.openai.com"
      - "*.anthropic.com"
      - "api.together.xyz"
      - "*.fireworks.ai"
      # Code hosting
      - "api.github.com"
      - "github.com"
      - "*.githubusercontent.com"
      - "gitlab.com"
      - "api.gitlab.com"
      - "bitbucket.org"
      - "api.bitbucket.org"
      # Package registries
      - "*.npmjs.org"
      - "registry.npmjs.org"
      - "registry.yarnpkg.com"
      - "pypi.org"
      - "files.pythonhosted.org"
      - "crates.io"
      - "static.crates.io"
      - "rubygems.org"
      - "packagist.org"
      # Documentation
      - "docs.rs"
      - "*.readthedocs.io"
      - "*.readthedocs.org"
      - "developer.mozilla.org"
    block: []
    default_action: block

  secret_leak:
    patterns:
      - name: aws_access_key
        pattern: "AKIA[0-9A-Z]{16}"
        severity: critical
      - name: github_token
        pattern: "gh[ps]_[A-Za-z0-9]{36}"
        severity: critical
      - name: openai_key
        pattern: "sk-[A-Za-z0-9]{48}"
        severity: critical
      - name: anthropic_key
        pattern: "sk-ant-[A-Za-z0-9\\-]{95}"
        severity: critical
      - name: private_key
        pattern: "-----BEGIN\\s+(RSA\\s+)?PRIVATE\\s+KEY-----"
        severity: critical
    skip_paths:
      - "**/test/**"
      - "**/tests/**"
      - "**/__tests__/**"
      - "**/*.test.*"
      - "**/*.spec.*"
      - "**/fixtures/**"
      - "**/mocks/**"

  patch_integrity:
    max_additions: 2000
    max_deletions: 1000
    require_balance: false
    max_imbalance_ratio: 20.0
    forbidden_patterns:
      - "(?i)disable[\\s_\\-]?(security|auth|ssl|tls)"
      - "(?i)rm\\s+-rf\\s+/"
      - "(?i)chmod\\s+777"
      - "(?i)reverse[_\\-]?shell"

  shell_command:
    enabled: true
    enforce_forbidden_paths: true

  mcp_tool:
    allow: []
    block:
      - shell_exec
      - run_command
    require_confirmation:
      - git_push
      - deploy
      - publish
    default_action: allow
    max_args_size: 2097152  # 2MB

  prompt_injection:
    enabled: true
    warn_at_or_above: suspicious
    block_at_or_above: high
    max_scan_bytes: 200000

  jailbreak:
    enabled: true
    detector:
      block_threshold: 70
      warn_threshold: 30
      max_input_bytes: 200000
      session_aggregation: true

settings:
  fail_fast: false
  verbose_logging: false
  session_timeout_secs: 7200  # 2 hours