Pack
dangerous-defaults
Destructive shell, disk, force-push, sudo, rc writes, curl|sh — mostly deny.
Extend in policy
extends:
- pack: dangerous-defaultsAlways extend this pack (or equivalent). It is the baseline that stops agents from finishing irreversible mistakes.
Typical denials:
rm -rf /and home wipesmkfs, raw disk writers- force-push / hard resets at pack boundaries (with git-safe)
sudo, profile/rc writescurl|shstyle pipe-to-shell
extends:
- pack: dangerous-defaults