Pack

`exec-escapes`

GTFOBins-style escapes — require approval, not blanket deny.

Default effect: require approval

Extend in policy

extends:
  - pack: exec-escapes

Agents sometimes need find -exec, xargs, or interpreter -c/-e legitimately. Humans confirm the escalation class instead of a hard deny that trains people to disable the gate.

All packs · Policy docs · Source YAML