NET-01　Shell network request

alert 0 hits here sandbox-verified

① What it stops

Agent made an external network request via shell command to a non-whitelisted domain

Pin downloads to whitelisted registries (npmjs/pypi/github) or review the destination.

② Criteria

Item	Value
Severity	warning
Category	network
Gate	Gate 4 behavior (egress)
Criterion type	tool_call
Applies to	Bash

Command patterns

\b(curl|wget|fetch)\b.*https?://
https?://(?!registry\.npmjs\.org|pypi\.org|github\.com)
\b(scp|sftp|rsync|ssh|nc|ncat)\b\s+[^\n]{0,120}@
\b(certutil|bitsadmin)\b[^\n]{0,120}(urlcache|transfer|/transfer|/urlcache)
Invoke-(WebRequest|RestMethod)|Start-BitsTransfer
\b(git\s+push|gh\s+(release|repo)\s+create)\b

Exclude patterns (hit ⇒ not blocked)

localhost
127\.0\.0\.1
registry\.npmjs\.org
pypi\.org
files\.pythonhosted\.org
github\.com
api\.github\.com
objects\.githubusercontent\.com

Generated directly from rules/default.json — never hand-written or paraphrased.

③ Real hits

2026-09-24T01:44:04+08:00 ✗ alert [NET-01] tool: Bash　exit code: 0 criterion: command hit: curl -s https://

Triggered in a disposable sandbox project using the real hooks/pre_tool_use.py — the same method as challenge/generate_challenge.py. All 24 rules verified this way (24/24).

Zero hits in the 13-day ledger on this machine — we do not post a sample. Zero hits means this machine never hit it, not that the rule is dead; effectiveness is covered by the sandbox trigger above.

④ False positives & exemptions

Built-in exclude patterns are listed under ②. Four exemption mechanisms exist globally (declared workspace roots, policy path whitelist, path-suspect alert-only, exclude patterns); counts on this machine are published on the Chinese page and in Limits.

⑤ Boundaries

Boundary
Criterion type	tool_call
Applies to	Bash
Platform	all platforms
Case sensitivity	Measured: insensitive (`RM -RF` is blocked like `rm -rf`)
Path normalisation	Measured: effective (`./sub/../.env` is blocked)
Scripts not parsed	An absolute path outside the project mentioned in a Bash command is alerted, not blocked — `scripts are not parsed (THREAT_MODEL Non-goals)`
Failure posture	fail-open; best-effort, not a hard security boundary

⑥ Reproduce

grep -h "NET-01" .psl/audit/*.jsonl | head python challenge/generate_challenge.py python challenge/verify.py

Cite this page

Antinel AgentState. NET-01 Shell network request — rule detail. https://antinel.com/en/agentstate/rules/NET-01/ (accessed YYYY-MM-DD)

Antinel. (2026). NET-01 Shell network request — rule detail. AgentState. https://antinel.com/en/agentstate/rules/NET-01/

BibTeX

@misc{antinel_en_agentstate_rules_NET_01,
  title        = {NET-01 Shell network request — rule detail},
  author       = {{Antinel}},
  year         = {2026},
  url          = {https://antinel.com/en/agentstate/rules/NET-01/},
  note         = {claim tier: measured}
}

Claim tier: measured　采集时刻：2026-09-23T22:41:18+08:00