Name: audit-runtime-safety
Author: xoate0100

Prompt file imported from xoate0100/CutRatesLawnWebSite (.cursor/commands/audit-runtime-safety.md). Copyright stays with the author.

/audit-runtime-safety — runtime & execution safety preflight

Follow the shared flow in _skeleton.md. This is the "floss before it rots" pass: find code that can hang, leak, corrupt, or take down the dev machine when an agent runs tests and scripts — before it runs them. Static analysis here; the runtime seatbelt is agentic/exec_guard.py (see Enforcement below).

Inventory

Enumerate what actually executes: test suites and their runner config, scripts (scripts/, bin/, npm/pnpm scripts, Makefile targets), watchers/dev servers, background jobs, migration/seed/wipe scripts, and anything an agent might invoke. Note which touch real data or external services.

Checks (the hazard classes)

Non-termination / runaway compute

infinite/unbounded loops (while(true) with no exit); unbounded or mutual recursion (stack overflow); accidental exponential algorithms; catastrophic regex backtracking (ReDoS); busy-wait/spin loops; retry with no cap/backoff; self-retriggering watcher/rebuild loops; tests with no per-test timeout.

Memory

leaks from retained refs, accumulating listeners/subscriptions, closures over large objects; structures that only grow (caches, queues); loading huge files/datasets fully into memory vs streaming; Promise.all over huge inputs; accumulating results in a loop until OOM.

Handles / descriptors / connections

unclosed files/streams (fd exhaustion); unclosed DB connections / pool exhaustion; leaked sockets / keep-alive agents; intervals/timers/watchers never disposed; temp files never cleaned up.

Concurrency / correctness

races on shared mutable state; TOCTOU; deadlock/livelock from lock ordering; unsynchronized parallel writes to the same file/table; missing await / async-ordering assumptions; non-idempotent ops run concurrently; flaky tests rooted in any of these.

Buffers / streams / I/O

buffer over/under-run and off-by-one on typed arrays (native/WASM interop); ignored stream backpressure (fast producer, slow consumer -> blowup); undrained child-process stdout/stderr -> pipe deadlock/hang; encoding mishandling; untrusted input into fixed buffers.

Disk / filesystem

filling the disk with logs/temp/artifacts; recursive writes into a watched or source dir; destructive ops on the wrong path (rm -rf, unguarded globs, writes outside a sandbox); path traversal in generated paths; symlink loops.

Process / OS blast radius (machine-killers)

fork bombs / unbounded subprocess spawn; builds/tests saturating all cores (-j unlimited); orphaned/zombie processes never reaped; signal mishandling killing the wrong PID; network floods that self-DDoS or trip rate limits/bans; running with admin rights against system paths.

External-service side effects during runs

tests hitting production DB/services; real emails/SMS/charges via live integrations (ActiveCampaign, Gmail, payments) because calls weren't mocked; migration/seed/wipe pointed at real data; real API keys loaded in a test run.

Security-of-execution

eval/dynamic exec of untrusted input; installing unpinned packages mid-run; curl | bash; secrets leaking into logs/artifacts a run produces.

Determinism / observability

no timeouts or resource caps configured anywhere; no output/log size caps; non-deterministic tests (wall-clock, RNG, live network); no cleanup-on-failure; ignored exit codes hiding failures.

Enforcement (pairs with this audit)

The audit finds hazards; agentic/exec_guard.py contains them at runtime. Runs must go through it: python -m agentic.exec_guard --timeout <s> --max-memory-mb <mb> -- <command> (or run_guarded(...)). Harness script tools are guarded automatically. For each finding, recommend the specific fix and the guard cap that would have contained it.

Evidence

File:line + hazard class + whether it's on an agent-invocable path (higher priority). Confirmed = traced/reproduced; Suspected = static-only.

Install audit-runtime-safety and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

# /audit-runtime-safety — runtime & execution safety preflight Follow the shared flow in `_skeleton.md`. This is the "floss before it rots" pass: find code that can hang, leak, corrupt, or take down the **dev machine** when an agent runs tests and scripts — *before* it runs them. Static analysis here; the runtime seatbelt is `agentic/exec_guard.py` (see Enforcement below). ## Inventory Enumerate what actually executes: test suites and their runner config, scripts (`scripts/`, `bin/`, npm/pnpm scripts, Makefile targets), watchers/dev servers, background jobs, migration/seed/wipe scripts, and anything an agent might invoke. Note which touch real data or external services. ## Checks (the hazard classes) **Non-termination / runaway compute** - infinite/unbounded loops (`while(true)` with no exit); unbounded or mutual recursion (stack overflow); accidental exponential algorithms; catastrophic regex backtracking (ReDoS); busy-wait/spin loops; retry with no cap/backoff; self-retriggering watcher/rebuild loops; tests with no per-test timeout. **Memory** - leaks from retained refs, accumulating listeners/subscriptions, closures over large objects; structures that only grow (caches, queues); loading huge files/datasets fully into memory vs streaming; `Promise.all` over huge inputs; accumulating results in a loop until OOM. **Handles / descriptors / connections** - unclosed files/streams (fd exhaustion); unclosed DB connections / pool exhaustion; leaked sockets / keep-alive agents; intervals/timers/watchers never disposed; temp files never cleaned up. **Concurrency / correctness** - races on shared mutable state; TOCTOU; deadlock/livelock from lock ordering; unsynchronized parallel writes to the same file/table; missing `await` / async-ordering assumptions; non-idempotent ops run concurrently; flaky tests rooted in any of these. **Buffers / streams / I/O** - buffer over/under-run and off-by-one on typed arrays (native/WASM interop); ignored stream backpressure (fast producer, slow consumer -> blowup); **undrained child-process stdout/stderr -> pipe deadlock/hang**; encoding mishandling; untrusted input into fixed buffers. **Disk / filesystem** - filling the disk with logs/temp/artifacts; recursive writes into a watched or source dir; destructive ops on the wrong path (`rm -rf`, unguarded globs, writes outside a sandbox); path traversal in generated paths; symlink loops. **Process / OS blast radius (machine-killers)** - fork bombs / unbounded subprocess spawn; builds/tests saturating all cores (`-j` unlimited); orphaned/zombie processes never reaped; signal mishandling killing the wrong PID; network floods that self-DDoS or trip rate limits/bans; running with admin rights against system paths. **External-service side effects during runs** - tests hitting **production** DB/services; real emails/SMS/charges via live integrations (ActiveCampaign, Gmail, payments) because calls weren't mocked; migration/seed/wipe pointed at real data; real API keys loaded in a test run. **Security-of-execution** - `eval`/dynamic exec of untrusted input; installing unpinned packages mid-run; `curl | bash`; secrets leaking into logs/artifacts a run produces. **Determinism / observability** - no timeouts or resource caps configured anywhere; no output/log size caps; non-deterministic tests (wall-clock, RNG, live network); no cleanup-on-failure; ignored exit codes hiding failures. ## Enforcement (pairs with this audit) The audit finds hazards; `agentic/exec_guard.py` contains them at runtime. Runs must go through it: `python -m agentic.exec_guard --timeout <s> --max-memory-mb <mb> -- <command>` (or `run_guarded(...)`). Harness `script` tools are guarded automatically. For each finding, recommend the specific fix **and** the guard cap that would have contained it. ## Evidence File:line + hazard class + whether it's on an agent-invocable path (higher priority). Confirmed = traced/reproduced; Suspected = static-only.

{ "prompt": "# /audit-runtime-safety — runtime & execution safety preflight\n\nFollow the shared flow in `_skeleton.md`. This is the \"floss before it rots\" pass:\nfind code that can hang, leak, corrupt, or take down the **dev machine** when an\nagent runs tests and scripts — *before* it runs them. Static analysis here; the\nruntime seatbelt is `agentic/exec_guard.py` (see Enforcement below).\n\n## Inventory\nEnumerate what actually executes: test suites and their runner config, scripts\n(`scripts/`, `bin/`, npm/pnpm scripts, Makefile targets), watchers/dev servers,\nbackground jobs, migration/seed/wipe scripts, and anything an agent might invoke.\nNote which touch real data or external services.\n\n## Checks (the hazard classes)\n\n**Non-termination / runaway compute**\n- infinite/unbounded loops (`while(true)` with no exit); unbounded or mutual\n recursion (stack overflow); accidental exponential algorithms; catastrophic\n regex backtracking (ReDoS); busy-wait/spin loops; retry with no cap/backoff;\n self-retriggering watcher/rebuild loops; tests with no per-test timeout.\n\n**Memory**\n- leaks from retained refs, accumulating listeners/subscriptions, closures over\n large objects; structures that only grow (caches, queues); loading huge\n files/datasets fully into memory vs streaming; `Promise.all` over huge inputs;\n accumulating results in a loop until OOM.\n\n**Handles / descriptors / connections**\n- unclosed files/streams (fd exhaustion); unclosed DB connections / pool\n exhaustion; leaked sockets / keep-alive agents; intervals/timers/watchers never\n disposed; temp files never cleaned up.\n\n**Concurrency / correctness**\n- races on shared mutable state; TOCTOU; deadlock/livelock from lock ordering;\n unsynchronized parallel writes to the same file/table; missing `await` /\n async-ordering assumptions; non-idempotent ops run concurrently; flaky tests\n rooted in any of these.\n\n**Buffers / streams / I/O**\n- buffer over/under-run and off-by-one on typed arrays (native/WASM interop);\n ignored stream backpressure (fast producer, slow consumer -> blowup);\n **undrained child-process stdout/stderr -> pipe deadlock/hang**; encoding\n mishandling; untrusted input into fixed buffers.\n\n**Disk / filesystem**\n- filling the disk with logs/temp/artifacts; recursive writes into a watched or\n source dir; destructive ops on the wrong path (`rm -rf`, unguarded globs,\n writes outside a sandbox); path traversal in generated paths; symlink loops.\n\n**Process / OS blast radius (machine-killers)**\n- fork bombs / unbounded subprocess spawn; builds/tests saturating all cores\n (`-j` unlimited); orphaned/zombie processes never reaped; signal mishandling\n killing the wrong PID; network floods that self-DDoS or trip rate limits/bans;\n running with admin rights against system paths.\n\n**External-service side effects during runs**\n- tests hitting **production** DB/services; real emails/SMS/charges via live\n integrations (ActiveCampaign, Gmail, payments) because calls weren't mocked;\n migration/seed/wipe pointed at real data; real API keys loaded in a test run.\n\n**Security-of-execution**\n- `eval`/dynamic exec of untrusted input; installing unpinned packages mid-run;\n `curl | bash`; secrets leaking into logs/artifacts a run produces.\n\n**Determinism / observability**\n- no timeouts or resource caps configured anywhere; no output/log size caps;\n non-deterministic tests (wall-clock, RNG, live network); no cleanup-on-failure;\n ignored exit codes hiding failures.\n\n## Enforcement (pairs with this audit)\nThe audit finds hazards; `agentic/exec_guard.py` contains them at runtime. Runs\nmust go through it:\n`python -m agentic.exec_guard --timeout <s> --max-memory-mb <mb> -- <command>`\n(or `run_guarded(...)`). Harness `script` tools are guarded automatically. For\neach finding, recommend the specific fix **and** the guard cap that would have\ncontained it.\n\n## Evidence\nFile:line + hazard class + whether it's on an agent-invocable path (higher\npriority). Confirmed = traced/reproduced; Suspected = static-only.", "variables": [], "notes": "Runtime & execution safety preflight — loops, leaks, handles, races, buffers, disk/process blast radius Arguments: [--fix] [--scope <path>].", "metadata": { "source": { "provider": "github-cursor-commands", "repository": "https://github.com/xoate0100/CutRatesLawnWebSite", "path": ".cursor/commands/audit-runtime-safety.md", "ref": "ac26d05f5a51d35377bbf5863a28dc737f99883a", "url": "https://github.com/xoate0100/CutRatesLawnWebSite/blob/ac26d05f5a51d35377bbf5863a28dc737f99883a/.cursor/commands/audit-runtime-safety.md", "key": "xoate0100/CutRatesLawnWebSite/.cursor/commands/audit-runtime-safety.md" } } }

audit-runtime-safety

About