DST-01　File deletion

block 68 hits here sandbox-verified

① What it stops

Agent executed a file or directory deletion command

Confirm the deletion target; prefer moving to trash over rm -rf outside build artifacts.

② Criteria

Item	Value
Severity	critical
Category	destructive
Gate	Gate 4 behavior (destructive/persistence)
Criterion type	tool_call
Applies to	Bash

Command patterns

\brm\b
\bdel\b
\brmdir\b
\bunlink\b
\bshutil\.rmtree\b
\bos\.remove\b
remove-item
(?:^|[;&|(]\s*|\s)rd(?:\s*[/][A-Za-z]|\s+[^=\s])
\bdd\s+if=[^\n]{0,80}\bof=/dev/
\bmkfs\b
\btruncate\s+-s\b
\bshred\s+-[a-z]*u?\b
\bmv\b[^\n]{0,120}\s/dev/null\b
(^|[;|&]\s*):\s*>\s*[^\s]
\brmSync\s*\(
\brm_rf\b
\bFileUtils\.rm\b
\bunlink\s+glob\b
array_map\(\s*["']unlink["']
\bosascript\b[^\n]{0,200}\bdelete\b
\bfind\b[^\n]{0,200}\s-delete\b

Exclude patterns (hit ⇒ not blocked)

rm -rf node_modules
rm -rf \.git
rm -rf __pycache__
rm -rf \.psl
remove-item node_modules
remove-item -recurse.*node_modules
\brm\s+-rf\s+(dist|build|target|venv|\.tox|\.mypy_cache|\.ruff_cache|\.pytest_cache|htmlcov|coverage|out|bin|obj)(\s|$|;)
\brm\s+-rf\s+\S*\.(egg-info|pyc)(\s|$|;)
\brm\s+-rf\s+\.nox\b
\\bgrep\\b
\\bfind\\b
\\bcat\\b
\\bhead\\b
\\btail\\b
\\btype\\b
\\bselect\\-string\\b
\\bdef\\s+\\w*(remove|unlink|delete)\\w*\\(
\\bos\\.remove\\b.*\\#
\\b#.*\\b(unlink|rm|del)\\b

Generated directly from rules/default.json — never hand-written or paraphrased.

③ Real hits

2026-09-24T01:44:08+08:00 ✗ block [DST-01] tool: Bash　exit code: 2 criterion: command hit: rm

Triggered in a disposable sandbox project using the real hooks/pre_tool_use.py — the same method as challenge/generate_challenge.py. All 24 rules verified this way (24/24).

Daily ledger on this machine: 68 hits

2026-09-10T09:55:21+08:00 ✗ blocked [DST-01] tool: Bash　host: zcode criterion: command os.remove

④ False positives & exemptions

Built-in exclude patterns are listed under ②. Four exemption mechanisms exist globally (declared workspace roots, policy path whitelist, path-suspect alert-only, exclude patterns); counts on this machine are published on the Chinese page and in Limits.

⑤ Boundaries

Boundary
Criterion type	tool_call
Applies to	Bash
Platform	all platforms
Case sensitivity	Measured: insensitive (`RM -RF` is blocked like `rm -rf`)
Path normalisation	Measured: effective (`./sub/../.env` is blocked)
Scripts not parsed	An absolute path outside the project mentioned in a Bash command is alerted, not blocked — `scripts are not parsed (THREAT_MODEL Non-goals)`
Failure posture	fail-open; best-effort, not a hard security boundary

⑥ Reproduce

grep -h "DST-01" .psl/audit/*.jsonl | head python challenge/generate_challenge.py python challenge/verify.py

Cite this page

Antinel AgentState. DST-01 File deletion — rule detail. https://antinel.com/en/agentstate/rules/DST-01/ (accessed YYYY-MM-DD)

Antinel. (2026). DST-01 File deletion — rule detail. AgentState. https://antinel.com/en/agentstate/rules/DST-01/

BibTeX

@misc{antinel_en_agentstate_rules_DST_01,
  title        = {DST-01 File deletion — rule detail},
  author       = {{Antinel}},
  year         = {2026},
  url          = {https://antinel.com/en/agentstate/rules/DST-01/},
  note         = {claim tier: measured}
}

Claim tier: measured　采集时刻：2026-09-23T22:41:18+08:00