scan_file_write
Scans file write operations for security threats before execution, checking for sensitive paths, path traversal, PII, secrets, and malicious code patterns to prevent data exposure.
Instructions
Scans a file write operation before execution for security threats.
Checks:
Sensitive file paths (.env, credentials, SSH keys, certificates)
Path traversal attacks (../, system directories)
PII in content (SSN, credit cards, emails)
Secrets in content (API keys, passwords, tokens)
Malicious code patterns (reverse shells, fork bombs)
Returns:
blocked: true/false
threat_type: path_traversal, secrets_exposure, etc.
severity: critical/high/medium/low
confidence: high/medium/low
guidance: actionable explanation
request_id: unique identifier
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | The target file path to write to | |
| content | Yes | The content to be written to the file | |
| mode | No | Write mode (default: overwrite) |