commands map to one of 20 action types like filesystem_delete, network_outbound, lang_exec, etc) matching againts JSON tables (optionally extended or overwritten via your YAML config). 3-phase lookup: 1) your config, then built-in flag classifiers for sed, awk, find etc, then the shipped defaults. First one wins.
each action type has a default policy: allow, context, ask, or block, where context means it checks where you are so rm inside your project is probably ok, but outside it gets flagged.
pipes are decomposed and each stage classified independently, and composition rules check the data flow: network | exec is blocked regardless of individual stage policies.
flag classifiers were the big unlock where instead of shipping thousands of prefixes, a few functions (about 20 commands) can handle different intents expressed in the same command.
naturally, lots of things will land outside the defaults and the flag classifiers (domain specific stuff for example) - the LLM can help disambiguate those. But sometimes, even the LLM is uncertain in which case we surface it to the human in charge. The buck stops with you.
Had a funny experience with this some weeks ago. I started developing a small side project and after a week I wondered if this existed already. To my surprise, someone had already built something relatively similar _with the exact same name_ (though I had chosen mine as a placeholder, still funny though) only 2 weeks before, and posted it in Show HN.
I took a look at the project and it was a 100k+ LoC vibe-coded repository. The project itself looked good, but it seemed quite excessive in terms of what it was solving. It made me think, I wonder if this exists because it is explicitly needed, or simply because it is so easy for it to exist?
lol, are AI companies patching this answer in real time. I thought it took months long effort for a training run. How would they make changes in such a short period?
The companies aren’t changing anything. LLM outputs are just more random than people realize. Run the same prompt 10 times if you really want to know how well they can answer.
Same here, I find most of these skills/prompts a bit redundant. Some people argue that in including these in the conversation, one is doing latent space management of sorts and bringing the model closer to where one wants it to be.
I wonder what will happen with new LLMs that contain all of these in their training data.