Sample. This report was generated from a fictional repository (a .env with a database URL, a key in a source file, a deploy workflow, and a CLAUDE.md with three prose rules) to show what the free written review looks like. Run it on your own setup: browser grader or gates/exposure_report.py from the kit. Back to the offer.
Agent exposure report: Example Co (fictional, 30 engineers)
Score: 1 / 10
Exposed. Today the model is the only thing standing between an agent and production.
What an agent can do today
| Gap | What succeeds right now | Fix |
|---|---|---|
| No PreToolUse hook on Bash | Any shell command the agent decides to run, runs. rm -rf, git push --force, curl ... | sh, terraform destroy are all one decision away. | A PreToolUse hook on Bash that denies by default near protected paths and blocks destructive patterns (this kit's bash_guard.py). |
| No PreToolUse hook on Write, Edit, MultiEdit or NotebookEdit | The agent can overwrite any file the process can, including .env, CI configs and deploy scripts. | A write guard that reads every path key in the payload and fails closed when it cannot (this kit's write_guard.py). |
| Nothing stops the agent from reading secret files | Reachable now: .env; cat on any of them succeeds. | Deny Read on .env*, *.pem, id_rsa, the secrets folder; move production secrets out of agent-reachable paths. |
Bash(git:*) is on the allow list | Every git command is pre-approved, including git push --force origin main, git reset --hard and git clean -fdx. No prompt appears. | Allow the read-only verbs you use (Bash(git status), Bash(git diff:*), Bash(git log:*)) and let the hook decide the rest. |
Read(**) is on the allow list | Reading any file is pre-approved, so .env, key files and credentials are read without a prompt even where a deny rule is missing. | Remove the blanket Read allow, or pair it with explicit deny rules for every secret path (deny wins over allow). |
| CLAUDE.md carries 3 prose rules and nothing enforces them | The agent reads 'never touch production' and usually complies. Usually is the problem: PocketOS had the same sentence. | Keep the prose for intent; add a hook for each rule that matters. |
| Unattended agent runs with no Bash hook | Nobody is there to press 'no'. A wrong step runs to completion. | Hooks first, then a sandboxed runner with no network path to production. |
| Secret-looking strings inside tracked files | Found: database URL with password in 1 file, OpenAI/Anthropic-style key in 1 file. An agent that greps the repo finds them too, and PocketOS is what happens next. | Rotate them, move them to a secrets manager, add the paths to the protected list. Values were not printed here. |
Weak spots
- Destructive-command deny rules are partial. Covered: rm. The others run unchallenged. Fix: Deny force push, reset --hard, git clean -f, recursive delete on root or home, and curl|sh, then back them with a hook because deny strings are matched literally.
- Nothing records what the agent tried and was blocked from. After an incident there is no log of agent actions to reconstruct from; before one there is no number to show anyone. Fix: An audit line per block and a monthly summary (this kit writes both).
- Cursor is in use and has its own permission model. settings.json does not cover it; a rule that holds in Claude Code can be absent in Cursor on the same repo. Fix: Mirror the deny rules in
.cursor/rulesand Cursor Business admin policy; test both (this kit ships a rules template). - CI configuration is writable by the agent. 1 pipeline file (.github/workflows/deploy.yml). A one-line edit exfiltrates every CI secret on the next run. Fix: Protect the CI directory with the write guard; require review on pipeline changes.
Already in place
- 1 deny rule present
- CLAUDE.md states intent (prose rules exist)
Next step
One repo, five evenings: hooks, permission rules, a written policy, and a test suite in your CI that proves every block above is closed. You pay after the tests pass. Free kit to start from: github.com/danielhagever/agent-guardrails-kit