full

Defense-of-defense layer. Signs and verifies Hydra's own defense-state files (active-canaries.json, egress-policy.json, capability-policy.json, rate-policy.json, hooks.json) so adversarial corruption can't silently disable a guard. Closes R-020 (F-PT-11/12/13/17).

Pre-execution classification and blocking of dangerous Bash commands.

PostToolUse advisory hook logging every WebFetch/WebSearch/Bash-network destination to append-only NDJSON. First-seen domains surface as stderr advisories.

PreToolUse advisory hook on npm/pip/uv/cargo/go/gem install. Five risk signals: existence, age, maintainer churn, typosquat (Levenshtein), download cliff. 24h URL-hash cache. Closes the supply-chain pre-install gap.

Opt-in PreToolUse blocking egress allowlist. Sibling of egress-monitor (advisory). When state/egress-policy.json sets enabled:true, blocks WebFetch/WebSearch/Bash-network calls whose destination host is not in the allowlist. Default disabled. Closes F-005.

Real-time secret detection in written files. 200+ patterns, Shannon entropy, Aho-Corasick matching.

Best-effort subagent-escape detection. PreToolUse hook compares the invoked tool against the active skill's allowed-tools frontmatter; logs out-of-lane invocations. Observability only — runtime sandboxing requires harness/SDK work.

OWASP Top 10 and CWE-mapped vulnerability detection in code changes. SCOPE TRUTH: a single-line regex prefilter, not a dataflow engine - it cannot follow taint across lines or functions, and several rules are shape-bound to HTTP handlers. Emits COVERAGE alongside findings, so an empty result reports whether the code was actually analysed rather than implying it is clean.

License compliance scanner over npm + pip dep trees against an allow/deny SPDX policy. Flags GPL/AGPL/SSPL as denied, MPL/EPL/CDDL as warned, MIT/Apache/BSD/ISC as allowed. CI-mode supports --fail-on-deny. Skill-invoked + release-workflow gate.

Session-start scanning for malicious repository configuration files.