DESIGN.md@examples/tool_safety designC
DESIGN.md@examples/tool_safety is agent-read markdown (design) from trpc-group/trpc-agent-python.
Indexed from public GitHub and served as immutable, content-addressed versions. Install it pinned to an exact SHA-256 with the mdr CLI, and every file is verified against the hash recorded here before it reaches your agent. The deterministic audit below grades the latest version, and the same file always earns the same grade.
What the file says
# Tool Script Safety Guard 设计文档
本文档说明 Tool Script Safety Guard 的请求处理流程，以及遇到不同风险程度命令时的决策和执行结果。
## 设计目标
Tool、Skill、MCP Tool 和 CodeExecutor 都可能执行脚本、shell 命令、外部进程或网络请求。Safety Guard 的目标是在真实执行前完成静态扫描和策略判断，把明显危险的请求拦截在执行边界外，并为不确定请求提供人工复核、审计和 telemetry 信息。
实现保持向后兼容：`BashTool` 和 `UnsafeLocalCodeExecutor` 默认不改变历史行为，只有显式设置 `enable_safety_guard=True` 后才启用扫描。`deny` 默认阻断执行；`needs_human_review` 默认记录但不阻断，设置 `block_on_review=True` 后也会阻断。
## 请求处理流程
```text
Tool / Skill / MCP Tool / CodeExecutor request
|
v
提取待执行内容
script / code / command / cmd / code_blocks
language / command_args / cwd / env / tool_metadata
|
v
ToolScriptScanRequest
|
v
ToolScriptSafetyScanner.scan()
|
+--> 语言归一化: python / bash / unknown
+--> 脱敏检测: script 和 env 中的 key/token/password/private_key
+--> Python AST 规则: open、Path、subprocess、os.system、requests、socket、eval、while True
+--> Bash 规则: rm、curl、wget、token 环境变量输出、敏感路径、管道、重定向、命令替换、依赖安装、sudo、sleep、fork bomb
+--> 执行上下文规则: cwd、timeout、max_output_bytes、command_args
+--> 用户注册规则: ToolScriptSafetyScanner.custom_rules / register_rule()
|
v
命中 RiskFinding 列表
…Read the whole file at its exact version.
How to install
mdr add trpc-group/trpc-agent-python/examples/tool_safety/DESIGN.md@git:20260731.fa1428fmdr add trpc-group/trpc-agent-python/examples/tool_safety/DESIGN.md@sha256:87cada287f0d8ca0Pin to a label to follow the author's releases, or to a sha256 to freeze the exact bytes forever. Either way the resolved hash is written to mdr.lock, and mdr install reproduces it on any machine.
[](https://markdownregistry.com/a/art_mq3zufs7fxomtqmn)
1 badge views in 30 days
Versions
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260731.fa1428f latest | 2026-07-31 | fa1428f | 16,776 B | C | view · diff |
| git:20260731.93d7c1c | 2026-07-31 | 93d7c1c | 16,707 B | C | view · diff |
| git:20260731.2478d9c | 2026-07-31 | 2478d9c | 16,646 B | C | view · diff |
| git:20260731.1153e7f | 2026-07-31 | 1153e7f | 16,713 B | C | view · diff |
| git:20260731.273cf2d | 2026-07-31 | 273cf2d | 12,306 B | C | view |
Audit of the latest version
- fail: No curl or wget piped into a shell (matched: curl ... \| sh)
- fail: No instruction to read or print local credentials (matched: cat .env)
- pass: Size between 200 bytes and 200 KB (16776 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No recursive delete of root, home or parent
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
trpc-group/trpc-agent-python · 143 stars · license NOASSERTION · pushed 2026-09-23 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_mq3zufs7fxomtqmn GET https://markdownregistry.com/api/v1/resolve?ref=trpc-group/trpc-agent-python/examples/tool_safety/DESIGN.md GET https://markdownregistry.com/api/v1/blob/87cada287f0d8ca03addd22cc62c553aaef111f1dc5c42378dd76d1cc4093e0f
Your agent does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.