CC Safety Net matched all 156 corpus checks. At standard, rm -rf * still runs.

CC Safety Net is a pre-execution guard for coding agents. It parses each shell command before it runs and blocks destructive file and git operations, plus reads of secrets like SSH keys and .env files. We wrote a 52-command corpus of destructive, obfuscated, secret-reading and everyday commands and ran it through the real library API at three safety levels, so 156 checks in all. Every row matched what we expected, in 611 ms. The catch is that two dangerous forms in that corpus, rm -rf * and $(echo rm) -rf /, are allowed at the default standard level.

The catch

Standard is the level you get unless you raise it. Four corpus commands change verdict by level:

The upstream README also says plainly that CC Safety Net is no sandbox. It does not contain processes, set filesystem permissions or watch network egress. It decides on a command string. A pass on our corpus means these 52 commands behave as listed at this pin, and a variant we did not write could still slip through. Run your agent at strict or above, and keep secrets out of the process environment too.

What we ran (keyless)

git clone --recurse-submodules https://github.com/SkilledDragonCorp/minilab-safety-net-secret-guard.git
cd minilab-safety-net-secret-guard
bun install --frozen-lockfile
bun test
bun run guard-corpus -- --json --level standard
bun run report

From reports/guard-corpus.json, run on October 14, 2026:

The corpus has 35 commands blocked at every level, 4 level-sensitive ones, and 13 everyday commands like git status, bun test and ls -la that must stay allowed. A row passes only when the verdict matches and every deny carries a non-empty reason and rule id. Where we pinned a rule id, it had to match exactly. cat ~/.ssh/id_ed25519 came back as secret.home.ssh, cat ~/.claude/.credentials.json as secret.cli.claude-code, git push -f origin main as git.push-force, and bash -c 'rm -rf /' as rm.recursive-force-root-or-home. Interpreter escapes such as python3 -c "import os; os.system('rm -rf /')" were blocked at every level.

How it is wired

CC Safety Net installs as a hook in the agent CLI. Before a shell tool call runs, the hook passes the command to checkCommand, which returns allow, or deny with a reason and a rule id that the agent sees. The lab calls the same function from cc-safety-net/api under a temporary policy file per level, then checks that cc-safety-net explain --json agrees with the library. Separate tests cover hook installation and the doctor command.

Minilab (open source)

Upstream is kenryu42/cc-safety-net (1,632 stars, MIT, TypeScript, as of October 14, 2026). Add your own commands to corpus/commands.json with an expected verdict per level, re-run bun run report, and check that failedRows in reports/guard-corpus.json stays empty.

bun install --frozen-lockfile && bun run report