All 24 rules

Every rule published, with field-level criteria — not a summary.

critical 17 / warning 7 / total 24. "hits here" = times this rule blocked on this one machine over 13 days (as of 2026-09-23).

#	ID	What it stops	Severity	Hits here
1	SEC-01	Agent attempted to read a .env file which may contain API keys and secrets	block	15
2	SEC-02	Agent attempted to read SSH private key or authorized_keys file	block	0
3	SEC-03	Agent attempted to read cloud provider credentials	block	0
4	SEC-04	Agent attempted to read cryptocurrency wallet or keystore file	block	2
5	SEC-05	Agent attempted to read browser stored data (cookies, passwords, sessions)	block	0
6	NET-01	Agent made an external network request via shell command to a non-whitelisted domain	alert	0
7	NET-02	Agent code contains Python network request calls	alert	0
8	NET-03	Agent command references a domain outside the whitelist (v1 compares command-line domains; DNS-level comparison is a v2 kernel-layer capability)	alert	0
9	DST-01	Agent executed a file or directory deletion command	block	68
10	DST-02	Agent attempted to write to a file outside the project root directory	block	28
11	DST-03	Agent attempted to modify shell startup configuration (persistence mechanism)	block	0
12	DST-04	Agent attempted to establish persistence (cron job, systemd service, startup item, scheduled task, registry Run key)	block	0
13	DST-05	Agent attempted to escalate privileges	alert	0
14	CTX-01	Agent attempted to enumerate all environment variables (may expose API keys and secrets)	alert	0
15	CTX-02	Potential prompt injection payload detected in skill instruction file	block	0
16	CTX-03	Invisible Unicode character detected (tag characters, zero-width, word joiner, BOM in middle of file)	block	2
17	CTX-04	Long base64 or hex string detected (potential encoded payload)	alert	0
18	CTX-05	SKILL.md frontmatter name field does not match parent directory name	alert	0
19	DST-06	Agent downloaded a remote script and piped it straight into a shell or interpreter	block	1
20	DST-07	Agent ran a git command that irreversibly discards working-tree changes or untracked files	block	0
21	SEC-06	Secret-looking literal (API key, private key, token) appeared in written or edited content	block	1
22	DST-08	Agent attempted to destroy permissions or ownership recursively (denial of service)	block	0
23	DST-09	Agent attempted to write an NTFS alternate data stream (path:stream) -- invisible to dir/ls and carried along by a plain file copy	block	0
24	DST-10	Agent attempted to write an NTFS alternate data stream from a shell (redirect / -Stream / copy / open) -- the command-line half of DST-09	block	3

Severity: block = the call is stopped; alert = allowed but recorded (another 511 alert records). Zero hits does not mean the rule is dead — it means this machine never encountered it. Every rule's effectiveness is verified by sandbox trigger (24/24).

Limits →　Real cases →

Cite this page

Antinel AgentState. All 24 rules — AgentState. https://antinel.com/en/agentstate/rules/ (accessed YYYY-MM-DD)

Antinel. (2026). All 24 rules — AgentState. AgentState. https://antinel.com/en/agentstate/rules/

BibTeX

@misc{antinel_en_agentstate_rules,
  title        = {All 24 rules — AgentState},
  author       = {{Antinel}},
  year         = {2026},
  url          = {https://antinel.com/en/agentstate/rules/},
  note         = {claim tier: measured}
}

Claim tier: measured　采集时刻：2026-09-23T22:41:18+08:00