agent-rules is a local installer. It reads a template, renders it with your machine's config, and writes the result into your AI tools' rule files. It performs no network I/O at install time.

The security-relevant surface is therefore: what it writes, and to where.

• Backup before write. Every target is copied to <target>.inst-bak-<ts> before it is modified.
• Merge, never clobber. Existing user content below the injected block is preserved. Only the block bounded by the BEGIN / END banners is replaced.
• Bounded writes. The installer writes to the platform rule files listed in the README, plus its own config at ~/.config/agent-rules.json. Nothing else.
• -Verify and -DryRun write nothing. -Verify is a read-only audit; -DryRun previews and does not even persist config.
• No secrets are collected. The config holds drive paths and thresholds only. It is git-ignored (agent-rules.config.json) so a drive layout is never committed by accident.

Please do not open a public issue for a security problem. Use GitHub's private advisory channel:

https://github.com/X1F2Y3/agent-rules/security/advisories/new

Include: the installer version (commit sha), the platform(s) affected, a reproduction, and the impact you believe it has. You can expect an acknowledgement within a few days.

• The design decision to modify files under a user's home directory — that is the tool's purpose, and it is documented.
• Anything an AI agent does because of a rule you asked to install.
• Third-party forks (CCB, Antigravity builds, claude-code-router) themselves; this repo only detects them.