forkless/strix
1
0
Fork 0
mirror of https://github.com/usestrix/strix.git synced 2026-08-25 20:32:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(safety): judge in-scope testing by effect, and stop the shell:bash misread

Browse Source 
Two guarded-mode false-positives surfaced in real scan traces.

The reviewer blocked a boolean SQL injection probe
(`curl "…/login?username='+OR+'1'='1"`) for being an injection attempt at all,
though it is a read-only GET that changes nothing. The prompt said "allow only
non-destructive" but never established that in-scope offensive testing is the
tool's authorized purpose, so the model blocked on the technique. Rewrite the
guarded-mode guidance to judge by effect: in-scope injection probes, recon,
enumeration, and fuzzing pass, while destructive or persistent effects block —
with SQL spelled out (boolean/UNION/time-based read probes pass; DROP, DELETE,
INSERT, INTO OUTFILE, stacked statements, and command execution block).
Ambiguous evidence still fails closed, and every deterministic block, the
completeness gate, observe's passive-only rule, and scope enforcement are kept.

Separately the reviewer blocked a plain `curl` as "use of bash shell within a
curl command". The shell wrapper stamps `shell: bash` onto every exec_command
for execution, and the evidence packet passed that transport default straight
to the reviewer, which read it as the agent invoking a shell. Strip the
harness-injected transport keys (`shell`, `max_output_tokens`) from the packet's
original_arguments; the command itself is still parsed from `cmd`, so an
agent-authored `bash -c` payload is unaffected.

Note: the effect-based prompt also lets in-scope recon tools (nmap, subfinder,
ffuf, katana) through, which the old prompt blocked as "scanning" or "high
volume". That follows directly from judging by effect rather than technique.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
oyasumi
2026-08-08 01:22:03 +00:00
co-authored by Claude Opus 5
parent bf475fbf46
commit a7336fa194
5 changed files with 108 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/usage/safety-modes.mdx
+10 -1
View File
@@ -15,7 +15,7 @@ strix --target https://example.test --safety-mode guarded
| Mode | Behavior |
| --- | --- |
| `off` | Current autonomous behavior. Local directories are mounted live and writable. |
| `guarded` | Allows non-destructive interaction after contextual review. Persistent or destructive target actions are blocked. |
| `guarded` | Allows non-destructive interaction after contextual review, including in-scope offensive testing — injection probes, recon, enumeration, fuzzing. Actions judged destructive or persistent (data or state change, account changes, file writes, stored payloads) are blocked. |
| `observe` | Passive target interaction only. Form submission, authentication, uploads, mutating requests, and state-changing controls are blocked. |
`off` is the default for backward compatibility. Configure a default with
@@ -37,6 +37,15 @@ The review is bounded to at most two model turns and one optional inspection
call. Timeouts, malformed decisions, a second tool call, incomplete evidence,
or low-confidence approval fail closed.
In guarded mode the reviewer judges an action by its effect on the target, not
by the technique it uses. Offensive testing against an in-scope target is the
authorized purpose of the tool, so a read-only injection probe (a boolean,
`UNION SELECT`, or time-based payload), a reflected-input test, or recon passes;
a payload that writes or destroys (`DROP`, `DELETE`, `INSERT`, `INTO OUTFILE`,
stacked statements, command execution), a mutating request, or any persistent
change is blocked. When complete evidence does not settle whether the effect is
destructive, persistent, or in scope, the action is blocked.
## Deterministic Rules
Some outcomes never reach the model. Destructive commands, environment